Chikololo Mmbetsa v Ceres Tech Limited

Complaint upheld; enforcement notice issued. ODPC, February 2026.

Record ID: ke-odpc-2026-0026
Case reference: ODPC Complaint No. 1763 of 2025
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Chikololo Mmbetsa
Date decided: February 2026
Respondent type: private
Sector: digital lending
Violations: lack of consent, commercial use of personal data, unlawful processing
Provisions cited: s.25 DPA 2019, s.26 DPA 2019, s.30 DPA 2019, s.30(1)(F) DPA 2019, s.30(1)(a) DPA 2019, s.32 DPA 2019, s.36 DPA 2019, s.37 DPA 2019, s.56(1) DPA 2019, s.56 DPA 2019, s.58 DPA 2019
Outcome: complaint upheld; enforcement notice issued
Status: final
Source: Official document ↗
Source integrity: SHA-256 d9417dbbc079f80e…
Record verified: 30 July 2026

The facts

The complainant alleged that the respondent sent him promotional messages marketing its products and services without his prior consent. The investigation established that the messages contained no functional opt-out or withdrawal mechanism, and the ODPC found the respondent had not fulfilled its obligations under the Act.

Orders and outcome

The respondent was found liable and an enforcement notice was issued against it. No compensation was ordered. Dated February 2026.

CONSENT · FINTECH · MOBILE-LENDING · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), Chikololo Mmbetsa v Ceres Tech Limited, ODPC Complaint No. 1763 of 2025, determination of February 2026. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2026/bora-credit/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.