Fridah Kemunto Obuba v Whitepath Company Limited

Complaint upheld; compensation ordered; enforcement notice issued. ODPC, 29 January 2025.

Record ID: ke-odpc-2025-0023
Case reference: ODPC Complaint No. 1764 of 2024
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Fridah Kemunto Obuba
Date decided: 29 January 2025
Respondent type: private
Sector: digital lending
Violations: unlawful processing
Provisions cited: s.25 DPA 2019, s.26(a) DPA 2019, s.56(1) DPA 2019, s.56 DPA 2019
Outcome: complaint upheld; compensation ordered; enforcement notice issued
Compensation: KES 450,000 (≈ USD 3,500 at the decision date)
Status: final
Source: Official document ↗
Source integrity: SHA-256 aed655e84c8530b1…
Record verified: 30 July 2026

The facts

The complainant alleged she received unsolicited communications from Whitepath Company Limited urging her to tell a loanee to clear a loan owed to the respondent. The ODPC found the respondent unlawfully processed her personal data and, intentionally or negligently, violated her right to be informed of the use to which her data would be put.

Orders and outcome

The respondent was found liable, an enforcement notice was issued, and it was ordered to pay the complainant Kenya Shillings four hundred and fifty thousand (KES 450,000) as compensation. Dated 29 January 2025.

FINTECH · MOBILE-LENDING · UNLAWFUL-PROCESSING

Cite this decision

ODPC (Kenya), Fridah Kemunto Obuba v Whitepath Company Limited, ODPC Complaint No. 1764 of 2024, determination of 29 January 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/whitepath-company-limited/ (accessed 30 August 2026).

Same respondent

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.