Silvia Wairimu Kiama v Kounkuey Design Initiative

Complaint upheld; compensation ordered. ODPC, March 2025.

Record ID

ke-odpc-2025-0009

Case reference

ODPC Complaint No. 1832 of 2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Silvia Wairimu Kiama

Date decided

March 2025

Respondent type

private

Sector

general

Violations

lack of consent, commercial use of personal data, failure to prevent data breach, failure to respond to erasure request, unlawful processing, failure to implement security measures

Provisions cited

s.25(b) DPA 2019, s.25 DPA 2019, s.25(D) DPA 2019, s.26(a) DPA 2019, s.26(c) DPA 2019, s.26 DPA 2019, s.30 DPA 2019, s.35 DPA 2019, s.36 DPA 2019, s.37 DPA 2019, s.41 DPA 2019, s.43 DPA 2019, s.56(1) DPA 2019, s.56 DPA 2019, s.65 DPA 2019

Outcome

complaint upheld; compensation ordered

Compensation

KES 250,000 (≈ USD 1,940 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 80e53341180ce4f4…

Record verified

30 July 2026

The facts

The complainant alleged that Kounkuey Design Initiative unlawfully disclosed her confidential financial and medical information, including final settlement, salary and payment details, by sending an email to a third party, her father, without her consent. The ODPC found the respondent violated her right to be informed of the use to which her personal data would be put.

Orders and outcome

The respondent was found liable and ordered to pay the complainant Kenya Shillings Two Hundred and Fifty Thousand (Kshs. 250,000) as compensation. Dated 2025.

CONSENT · DATA-BREACH · DATA-SECURITY · GENERAL · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.