John Mkomba Nzau v Kuza Sacco Society Limited

Complaint upheld; compensation ordered. ODPC, August 2025.

Record ID: ke-odpc-2025-0071
Case reference: ODPC Complaint No. 0681 of 2025
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: John Mkomba Nzau
Date decided: August 2025
Respondent type: private
Sector: banking
Violations: lack of consent, commercial use of personal data, failure to respond to erasure request, unlawful processing
Provisions cited: s.25 DPA 2019, s.26(c) DPA 2019, s.28 DPA 2019, s.29 DPA 2019, s.32 DPA 2019, s.37(1)(b) DPA 2019, s.40 DPA 2019, s.56(1) DPA 2019, s.56 DPA 2019, s.65 DPA 2019
Outcome: complaint upheld; compensation ordered
Compensation: KES 50,000 (≈ USD 390 at the decision date)
Status: final
Source: Official document ↗
Source integrity: SHA-256 ad54f06a175de6cf…
Record verified: 30 July 2026

The facts

The complainant, who is not a member of Kuza Sacco Society Limited, alleged he received unsolicited messages from it on his personal number without his consent. The ODPC found his right to object to processing was infringed.

Orders and outcome

The respondent was found liable and ordered to pay the complainant Kenya Shillings Fifty Thousand (KES 50,000) for the infringement of his rights. Dated August 2025.

BANKING · CONSENT · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), John Mkomba Nzau v Kuza Sacco Society Limited, ODPC Complaint No. 0681 of 2025, determination of August 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/kuza-sacco-limited/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.