Brian Githaiga v Ncba Bank Kenya Ltd

Complaint upheld; compensation ordered. ODPC, March 2025.

Record ID: ke-odpc-2025-0011
Case reference: ODPC Complaint No. 1679 of 2024
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Brian Githaiga
Date decided: March 2025
Respondent type: private
Sector: banking
Violations: failure to respond to erasure request, unlawful processing
Provisions cited: s.25 DPA 2019, s.40(1)(b) DPA 2019, s.56(1) DPA 2019, s.65(4) DPA 2019, s.65 DPA 2019
Outcome: complaint upheld; compensation ordered
Compensation: KES 250,000 (≈ USD 1,940 at the decision date)
Status: final
Source: Official document ↗
Source integrity: SHA-256 80caf321f4dd5674…
Record verified: 30 July 2026

The facts

The complainant alleged that NCBA Bank Kenya failed to rectify and update his accurate email address after a third party's email address was recorded against his business account. The ODPC found the bank intentionally or negligently violated his right of erasure by failing to correct the address in its database even after his instructions.

Orders and outcome

The respondent was ordered to erase the third party's email address from the complainant's business account within fourteen days and to compensate him Kenya Shillings Two Hundred and Fifty Thousand (KES 250,000). Dated January 2025.

BANKING · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), Brian Githaiga v Ncba Bank Kenya Ltd, ODPC Complaint No. 1679 of 2024, determination of March 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/ncba-bank-kenya-ltd/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.