Elias Cheruiyot Korir v Thika Water and Sewerage Company

Complaint upheld; compensation ordered; enforcement notice issued. ODPC, September 2025.

Record ID

ke-odpc-2025-0085

Case reference

ODPC Complaint No. 0917 of 2025

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Elias Cheruiyot Korir

Date decided

September 2025

Respondent type

private

Sector

public services

Violations

failure to prevent data breach, unlawful processing

Provisions cited

s.25(F) DPA 2019, s.25 DPA 2019, s.26(c) DPA 2019, s.26 DPA 2019, s.40 DPA 2019, s.56(1) DPA 2019, s.56 DPA 2019, s.58 DPA 2019, s.65 DPA 2019

Outcome

complaint upheld; compensation ordered; enforcement notice issued

Compensation

KES 250,000 (≈ USD 1,940 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 05a93b97d277b558…

Record verified

30 July 2026

The facts

The complainant's mobile number was being used by Thika Water and Sewerage Company to send billing messages linked to a deceased third party's account. He never consented and expressly objected on 26 March 2025, but the billing messages continued until 24 June 2025, with corrective action taken only after a belated system check. The ODPC found his right to object infringed.

Orders and outcome

The respondent was found liable, ordered to pay the complainant Kenya Shillings Two Hundred and Fifty Thousand (Kshs. 250,000) as compensation, and an enforcement notice was issued against it. Dated September 2025.

DATA-BREACH · UNLAWFUL-PROCESSING · UPHELD · UTILITIES

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.