The complainant alleged that Whitepath Company Limited, without his consent or any lawful basis, unlawfully collected and processed his telephone number for purposes of recovering a non-existent loan. The ODPC found the respondent unlawfully collected, processed and disclosed his personal data and violated his right to be informed.
Orders and outcome
The respondent was found liable and directed to compensate the complainant KES 350,000, the Office taking into account the nature and extent of the violation and the harm occasioned. Dated January 2026.
ODPC (Kenya), Kennedy Wambugu v Whitepath, ODPC Complaint No. 1479 of 2025, determination of January 2026. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2026/whitepath/ (accessed 23 October 2026).
Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.