Martin Gikonyo v Kingdom Bank

Complaint dismissed. ODPC, July 2025.

Record ID: ke-odpc-2025-0041
Case reference: ODPC Complaint No. 0372 of 2025
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Martin Gikonyo
Date decided: July 2025
Respondent type: private
Sector: banking
Violations: unlawful data disclosure, unlawful processing
Provisions cited: s.25 DPA 2019, s.56 DPA 2019
Outcome: complaint dismissed
Status: final
Source: Official document ↗
Source integrity: SHA-256 22513f522e76f13c…
Record verified: 30 July 2026

The facts

The complainant alleged that Kingdom Bank Ltd shared his personal data with the National Council of Persons with Disabilities and the Consolidated Bank of Kenya's legal department without his consent. The ODPC found the email correspondence contained no personal identifier that could strictly identify him; his NCPWD number was never disclosed, and all parties were involved in the correspondence over a dispute his own advocates had raised.

Orders and outcome

The complaint was found to lack merit and was dismissed, with no remedy due. Dated June 2025.

BANKING · DISCLOSURE · DISMISSED · UNLAWFUL-PROCESSING

Cite this decision

ODPC (Kenya), Martin Gikonyo v Kingdom Bank, ODPC Complaint No. 0372 of 2025, determination of July 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/kingdom-bank/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.