Dorcas Ntinyari Savini v Megahealth Ins

Complaint upheld; compensation ordered. ODPC, 19 January 2026.

Record ID: ke-odpc-2026-0030
Case reference: ODPC Complaint No. 1551 of 2025
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Dorcas Ntinyari Savini
Date decided: 19 January 2026
Respondent type: private
Sector: healthcare
Violations: lack of consent, commercial use of personal data, failure to respond to erasure request, unlawful processing
Provisions cited: s.25 DPA 2019, s.26(a) DPA 2019, s.28(1) DPA 2019, s.29 DPA 2019, s.30 DPA 2019, s.37(1) DPA 2019, s.56 DPA 2019, s.65(4) DPA 2019, s.65(2) DPA 2019, s.65(1) DPA 2019
Outcome: complaint upheld; compensation ordered
Compensation: KES 412,500 (≈ USD 3,200 at the decision date)
Status: final
Source: Official document ↗
Source integrity: SHA-256 2f3ffdcdcdbec1ce…
Record verified: 30 July 2026

The facts

The complainant alleged the respondent processed her personal data for marketing purposes without her express consent or any other lawful basis. The ODPC found the respondent processed her data unlawfully, failed to comply with the data protection principles, violated her right to be informed, processed her data for direct marketing and failed to fulfil the duty to notify.

Orders and outcome

The respondent was found liable and ordered to compensate the complainant KES 412,500. Dated 19 January 2026.

CONSENT · HEALTHCARE · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), Dorcas Ntinyari Savini v Megahealth Ins, ODPC Complaint No. 1551 of 2025, determination of 19 January 2026. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2026/megahealth-ins/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.