Catherine Wairimu Gabriel v Penda

Complaint upheld; compensation ordered. ODPC, 28 January 2026.

Record ID: ke-odpc-2026-0035
Case reference: ODPC Complaint No. 1672 of 2025
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Catherine Wairimu Gabriel
Date decided: 28 January 2026
Respondent type: private
Sector: healthcare
Violations: unauthorised image/photo use, lack of consent, commercial use of personal data, unlawful data disclosure, failure to prevent data breach, unlawful processing
Provisions cited: s.25 DPA 2019, s.26 DPA 2019, s.28(2)(c) DPA 2019, s.29 DPA 2019, s.30 DPA 2019, s.32(2) DPA 2019, s.37 DPA 2019, s.56 DPA 2019, s.65 DPA 2019
Outcome: complaint upheld; compensation ordered
Compensation: KES 50,000 (≈ USD 390 at the decision date)
Status: final
Source: Official document ↗
Source integrity: SHA-256 0c8a2da7ee86adb9…
Record verified: 30 July 2026

The facts

The complainant alleged that Penda Health Limited used her personal data to send promotional messages although she had not given prior consent and had opted out. The ODPC found the respondent liable for failing to fulfil the duty to notify, taking into account the number of messages sent and the respondent's conduct, including attempts to settle the matter amicably.

Orders and outcome

The respondent was found liable and ordered to pay the complainant KES 50,000 as compensation. Dated 28 January 2026.

CONSENT · DATA-BREACH · DISCLOSURE · HEALTHCARE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), Catherine Wairimu Gabriel v Penda, ODPC Complaint No. 1672 of 2025, determination of 28 January 2026. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2026/penda/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.