Esther Gitau v Shree Swaminarayan Hospital

Complaint upheld; enforcement notice issued. ODPC, 9 December 2025.

Record ID: ke-odpc-2026-0036
Case reference: ODPC Complaint No. 1391 of 2025
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Esther Gitau
Date decided: 9 December 2025
Respondent type: private
Sector: healthcare
Violations: unlawful data disclosure, unlawful processing
Provisions cited: s.25 DPA 2019, s.44 DPA 2019, s.46 DPA 2019, s.56 DPA 2019, s.58 DPA 2019
Outcome: complaint upheld; enforcement notice issued
Status: final
Source: Official document ↗
Source integrity: SHA-256 b165808b2a1c6bd9…
Record verified: 31 July 2026

The facts

The complainant alleged that Shree Swaminarayan Hospital shared another patient's medical data with her. The ODPC found that the hospital did not process the third party's health data in accordance with the law and abrogated its responsibility over the complainant's own health data, finding a violation of the Act.

Orders and outcome

The respondent was found liable and an enforcement notice was issued against it. Parties have the right to appeal to the High Court of Kenya within thirty days. Dated 9 December 2025.

DISCLOSURE · HEALTHCARE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), Esther Gitau v Shree Swaminarayan Hospital, ODPC Complaint No. 1391 of 2025, determination of 9 December 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/shree-shaminarayan-hospital/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.