The complainant alleged he received multiple calls from the respondent's agent about a loan for which he had been listed as a guarantor without his consent. The ODPC found the respondent liable for processing his personal data without a lawful basis and for denying him the opportunity to exercise his right to be informed before the processing, and treated the unauthorised disclosure of his personal data as an offence under the Act.
Orders and outcome
The respondent was ordered to pay the complainant Kenya Shillings Two Hundred and Fifty Thousand (KES 250,000) as compensation, and an enforcement notice was issued to compel it to erase all data relating to the complainant and furnish proof. Dated 2025, with the day and month illegible in the scan.
ODPC (Kenya), Dennis Caleb Owuor v Whitepath Company, ODPC Complaint No. 1931 of 2024, determination of March 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/whitepath-company/ (accessed 30 August 2026).