Alphax

Complaint upheld; enforcement notice issued. ODPC, 16 December 2025.

Record ID

ke-odpc-2025-0095

Case reference

ODPC/SM/0002/2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Date decided

16 December 2025

Respondent type

private

Sector

general

Violations

lack of consent, commercial use of personal data, unlawful data disclosure, failure to respond to erasure request, unlawful processing, failure to implement security measures

Provisions cited

s.25(b) DPA 2019, s.25(G) DPA 2019, s.25(D) DPA 2019, s.25 DPA 2019, s.26 DPA 2019, s.27(a) DPA 2019, s.29(D) DPA 2019, s.29(H) DPA 2019, s.29(a) DPA 2019, s.29 DPA 2019, s.29(F) DPA 2019, s.30 DPA 2019, s.32(1) DPA 2019, s.32(4) DPA 2019, s.32(2) DPA 2019, s.32 DPA 2019, s.37(1) DPA 2019, s.57(3) DPA 2019, s.57(1) DPA 2019, s.58 DPA 2019

Outcome

complaint upheld; enforcement notice issued

Status

final

Source

Official document ↗

Record verified

6 July 2026

Summary

The ODPC upheld a complaint against Alphax concerning lack of consent, commercial use of personal data, unlawful data disclosure. The determination considers s.25(b) DPA 2019, s.25(G) DPA 2019, s.25(D) DPA 2019, s.25 DPA 2019. An enforcement notice was issued against the respondent.

CONSENT · DATA-SECURITY · DISCLOSURE · GENERAL · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.