Penda

Complaint upheld. ODPC, February 2026. month-precision date

Record ID: ke-odpc-2026-0035
Case reference: ODPC Complaint No. 1672 of 2025
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Date decided: February 2026
Respondent type: private
Sector: healthcare
Violations: unauthorised image/photo use, lack of consent, commercial use of personal data, unlawful data disclosure, failure to prevent data breach, unlawful processing
Provisions cited: s.25 DPA 2019, s.26 DPA 2019, s.28(2)(c) DPA 2019, s.29 DPA 2019, s.30 DPA 2019, s.32(2) DPA 2019, s.37 DPA 2019, s.56 DPA 2019, s.65 DPA 2019
Outcome: complaint upheld
Status: final
Source: Official document ↗
Record verified: 12 March 2026

Summary

The ODPC upheld a complaint against Penda in the healthcare sector concerning unauthorised image/photo use, lack of consent, commercial use of personal data. The determination considers s.25 DPA 2019, s.26 DPA 2019, s.28(2)(c) DPA 2019, s.29 DPA 2019.

CONSENT · DATA-BREACH · DISCLOSURE · HEALTHCARE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), ODPC Complaint No. 1672 of 2025, determination of February 2026. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2026/penda/ (accessed 22 July 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.