EFK v Quest Holdings Ltd

Complaint upheld; compensation ordered; enforcement notice issued. ODPC, September 2025.

Record ID

ke-odpc-2025-0080

Case reference

ODPC Complaint No. 0884 of 2025

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

EFK

Date decided

September 2025

Respondent type

private

Sector

general

Violations

unlawful data disclosure, failure to prevent data breach, unlawful processing, failure to implement security measures

Provisions cited

s.25(a) DPA 2019, s.25 DPA 2019, s.41 DPA 2019, s.41(1) DPA 2019, s.42(4) DPA 2019, s.42 DPA 2019, s.43 DPA 2019, s.56 DPA 2019, s.58 DPA 2019, s.65(4) DPA 2019, s.65(2) DPA 2019, s.65(1) DPA 2019

Outcome

complaint upheld; compensation ordered; enforcement notice issued

Compensation

KES 250,000 (≈ USD 1,940 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 a2fbf6dd8b104ca6…

Record verified

22 September 2026

The facts

The complainant, identified in the determination by the initials EFK, alleged that an employee of Quest Holdings Limited, acting in the course of employment, erroneously attached and disseminated a confidential file containing personal data of NCBA Bank customers, including names, email addresses and outstanding financial amounts, to unintended recipients through a mail merge email. The ODPC found the respondent failed to process personal data in accordance with the data protection principles and failed to put in place effective technical and organisational measures.

Orders and outcome

The respondent was found liable, an enforcement notice was issued against it, and it was ordered to compensate the complainant KES 250,000. Dated September 2025.

CONSENT · DATA-BREACH · DATA-SECURITY · DISCLOSURE · GENERAL · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.