Erickson Kipkirui Langat v AGC Tenwek Hospital

Complaint upheld; compensation ordered; enforcement notice issued. ODPC, 29 September 2025.

Record ID

ke-odpc-2025-0054

Case reference

ODPC Complaint No. 0966 of 2025

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Erickson Kipkirui Langat

Date decided

29 September 2025

Respondent type

private

Sector

general

Violations

lack of consent, commercial use of personal data, unlawful processing

Provisions cited

s.25 DPA 2019, s.25(c) DPA 2019, s.26(a) DPA 2019, s.26 DPA 2019, s.30 DPA 2019, s.32 DPA 2019, s.37 DPA 2019, s.37(1) DPA 2019, s.56(1) DPA 2019, s.56 DPA 2019, s.58 DPA 2019, s.65(4) DPA 2019, s.65 DPA 2019

Outcome

complaint upheld; compensation ordered; enforcement notice issued

Compensation

KES 250,000 (≈ USD 1,940 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 3bf5325f0f40eb20…

Record verified

30 July 2026

The facts

The complainant provided his phone number to AGC Tenwek Hospital solely for registration and payment of bills, and alleged the hospital then sent him unsolicited marketing messages, repurposing his personal data for direct marketing without his express consent. The ODPC found the hospital liable for processing his data beyond the purpose for which it was collected, without his knowledge or consent.

Orders and outcome

The respondent was ordered to pay the complainant Kenya Shillings Two Hundred and Fifty Thousand (KES 250,000) as compensation, and an enforcement notice was issued to compel it to erase all data relating to the complainant and furnish proof. Dated 29 September 2025.

CONSENT · GENERAL · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.