Eldoret Hospital

Suo moto investigation; enforcement notice issued. ODPC, December 2025.

Record ID

ke-odpc-2026-0007

Case reference

ODPC Suo Moto Investigation No. ODPC/SM/0003/2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Date decided

December 2025

Respondent type

private

Sector

healthcare

Violations

unlawful data disclosure, failure to prevent data breach, obstruction of data commissioner, failure to conduct dpia, unlawful processing, failure to register with odpc, failure to implement security measures

Provisions cited

s.25(G) DPA 2019, s.25(b) DPA 2019, s.25 DPA 2019, s.25(D) DPA 2019, s.26 DPA 2019, s.29 DPA 2019, s.30(1)(b) DPA 2019, s.30(1) DPA 2019, s.41 DPA 2019, s.58 DPA 2019

Outcome

suo moto investigation; enforcement notice issued

Status

final

Source

Official document ↗

Source integrity

SHA-256 d68815abefff046c…

Record verified

30 July 2026

The facts

A suo moto investigation by the ODPC into the personal data processing practices of Eldoret Hospital, a medical facility processing high volumes of personal data including patients' health data, opened after concerns and public interest arose over the entity's practices. The Office found the hospital in breach of its obligations and non-compliant to the extent set out in the determination.

Orders and outcome

The respondent was found non-compliant in respect of the suo moto investigation and an enforcement notice was issued against it. Dated December 2025.

DATA-BREACH · DATA-SECURITY · DISCLOSURE · HEALTHCARE · OBSTRUCTION · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.