Zahira Ninah Mwalimu v Joshua Misaro

Complaint upheld; compensation ordered; enforcement notice issued. ODPC, October 2025.

Record ID: ke-odpc-2025-0069
Case reference: ODPC Complaint No. 0886 of 2025
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Zahira Ninah Mwalimu
Date decided: October 2025
Respondent type: individual
Sector: general
Violations: lack of consent, unlawful data disclosure, unlawful processing, failure to implement security measures
Provisions cited: s.25 DPA 2019, s.41 DPA 2019, s.42(3) DPA 2019, s.42 DPA 2019, s.56 DPA 2019, s.65(4) DPA 2019, s.65(2) DPA 2019, s.65(1) DPA 2019
Outcome: complaint upheld; compensation ordered; enforcement notice issued
Compensation: KES 100,000 (≈ USD 780 at the decision date)
Status: final
Source: Official document ↗
Source integrity: SHA-256 a2a42c96167c1c77…
Record verified: 30 July 2026

The facts

The complainant entrusted her deed poll and supporting affidavits to a cybercafe for the limited purpose of printing on or about 24 January 2025. The documents were then uploaded to the Scribd online platform, making them publicly accessible and exposing her personal data to unauthorised disclosure. The ODPC found the respondent unlawfully processed her personal data.

Orders and outcome

The respondent was found liable, an enforcement notice was issued, and he was ordered to compensate the complainant KES 100,000. Dated September 2025.

CONSENT · DATA-SECURITY · DISCLOSURE · GENERAL · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), Zahira Ninah Mwalimu v Joshua Misaro, ODPC Complaint No. 0886 of 2025, determination of October 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/joshua/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.