Catherine Wairimu Gabriel v Penda

Complaint upheld; compensation ordered. ODPC, 28 January 2026.

Record ID

ke-odpc-2026-0035

Case reference

ODPC Complaint No. 1672 of 2025

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Catherine Wairimu Gabriel

Date decided

28 January 2026

Respondent type

private

Sector

healthcare

Violations

unauthorised image/photo use, lack of consent, commercial use of personal data, unlawful data disclosure, failure to prevent data breach, unlawful processing

Provisions cited

s.25 DPA 2019, s.26 DPA 2019, s.28(2)(c) DPA 2019, s.29 DPA 2019, s.30 DPA 2019, s.32(2) DPA 2019, s.37 DPA 2019, s.56 DPA 2019, s.65 DPA 2019

Outcome

complaint upheld; compensation ordered

Compensation

KES 50,000 (≈ USD 390 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 0c8a2da7ee86adb9…

Record verified

30 July 2026

The facts

The complainant alleged that Penda Health Limited used her personal data to send promotional messages although she had not given prior consent and had opted out. The ODPC found the respondent liable for failing to fulfil the duty to notify, taking into account the number of messages sent and the respondent's conduct, including attempts to settle the matter amicably.

Orders and outcome

The respondent was found liable and ordered to pay the complainant KES 50,000 as compensation. Dated 28 January 2026.

CONSENT · DATA-BREACH · DISCLOSURE · HEALTHCARE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.