Francis James Kioko v Tower Savings & Credit Cooperative Society Limited

Complaint upheld; enforcement notice issued. ODPC, 15 December 2025.

Record ID

ke-odpc-2026-0022

Case reference

ODPC Complaint No. 1363 of 2025

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Francis James Kioko

Date decided

15 December 2025

Respondent type

private

Sector

banking

Violations

lack of consent, commercial use of personal data, unlawful processing, failure to implement security measures

Provisions cited

s.25(b) DPA 2019, s.25 DPA 2019, s.26(c) DPA 2019, s.29 DPA 2019, s.30 DPA 2019, s.32(3) DPA 2019, s.34 DPA 2019, s.34(2) DPA 2019, s.34(1)(D) DPA 2019, s.34(1)(a) DPA 2019, s.36 DPA 2019, s.40 DPA 2019, s.41 DPA 2019, s.41(1) DPA 2019, s.56 DPA 2019, s.58 DPA 2019

Outcome

complaint upheld; enforcement notice issued

Status

final

Source

Official document ↗

Source integrity

SHA-256 747a070097a01110…

Record verified

30 July 2026

The facts

The complainant alleged that the Sacco collected and processed his personal data for commercial purposes without his express consent or another lawful basis, and continued sending him marketing messages after he objected. The ODPC found the respondent's technical and organisational measures fell short of the standard the Act imposes and held it in violation of its obligations as a data controller.

Orders and outcome

The respondent was found liable and an enforcement notice was ordered to issue against it, the Office taking into account the lack of technical and organisational safeguards in its processing operations. No compensation was ordered. Dated 15 December 2025.

BANKING · CONSENT · DATA-SECURITY · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.