commercial use of personal data, unlawful data disclosure, failure to prevent data breach, unlawful debt collection, failure to respond to erasure request, unlawful processing
The complainant alleged that Chapeo Capital Limited, operating ZK Pesa, unlawfully processed his personal data by designating him as a loan guarantor using information supplied by the second respondent, an individual, without verifying it, informing him or obtaining his consent. The ODPC found the first respondent violated his right to be informed and processed his data unlawfully, and that the second respondent assumed controller responsibility by disclosing the complainant's personal data without consent, which constitutes an offence.
Orders and outcome
The respondents were found liable. The first respondent was ordered to pay the complainant Kenya Shillings Two Hundred and Fifty Thousand (KES 250,000) as compensation and an enforcement notice was issued against it. A recommendation for prosecution was made against the second respondent. Dated May 2025.
ODPC (Kenya), Eric Munene Njuguna v Chapeo Capital Limited (ZK Pesa) and Ericson Lubale Okota, ODPC Complaint No. 0238 of 2025, determination of May 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/chapeo/ (accessed 30 August 2026).