EFK v Quest Holdings Ltd

Complaint upheld; compensation ordered; enforcement notice issued. ODPC, September 2025.

Record ID

ke-odpc-2025-0080

Case reference

ODPC Complaint No. 0884 of 2025

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

EFK

Date decided

September 2025

Respondent type

private

Sector

general

Violations

lack of consent, unlawful data disclosure, failure to prevent data breach, failure to notify data breach, unlawful processing, failure to implement security measures

Provisions cited

s.25(a) DPA 2019, s.25 DPA 2019, s.41 DPA 2019, s.41(1) DPA 2019, s.42(4) DPA 2019, s.42 DPA 2019, s.43 DPA 2019, s.56 DPA 2019, s.58 DPA 2019, s.65(4) DPA 2019, s.65(2) DPA 2019, s.65(1) DPA 2019

Outcome

complaint upheld; compensation ordered; enforcement notice issued

Compensation

KES 250,000 (≈ USD 1,940 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 a2fbf6dd8b104ca6…

Record verified

30 July 2026

The facts

The complainant, identified in the determination by the initials EFK, alleged that an employee of Quest Holdings Limited, acting in the course of employment, erroneously attached and disseminated a confidential file containing personal data of NCBA Bank customers, including names, email addresses and outstanding financial amounts, to unintended recipients through a mail merge email. The ODPC found the respondent failed to process personal data in accordance with the data protection principles and failed to put in place effective technical and organisational measures.

Orders and outcome

The respondent was found liable, an enforcement notice was issued against it, and it was ordered to compensate the complainant KES 250,000. Dated September 2025.

CONSENT · DATA-BREACH · DATA-SECURITY · DISCLOSURE · GENERAL · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.