Kenya’s Data Protection Crackdown: Can the ODPC Enforce the Law Effectively?

Kenya’s data-protection regime is entering a more consequential phase. The Office of the Data Protection Commissioner (ODPC), established under the Data Protection Act, 2019, is no longer simply educating organisations about privacy obligations. It is investigating complaints, issuing enforcement notices, imposing administrative penalties and ordering compensation for people whose personal data has been mishandled.

That shift matters as banks, digital lenders, hospitals, schools, employers, technology platforms and public institutions collect increasingly large amounts of personal information. The commercial value of that data is growing. So is the risk that it will be collected without a proper legal basis, shared too widely, retained for too long or used for purposes people never agreed to.

The central question is no longer whether Kenya has a data-protection law. It is whether its watchdog has the resources, consistency and reach to make the law effective across the economy.

The dispute involving Mulla Pride Limited, which operates digital-credit businesses including KeCredit and FairKash, illustrates the changing relationship between the regulator and the organisations it supervises.

The ODPC issued the company a penalty notice for KSh2.975 million in September 2023 following enforcement proceedings connected to its handling of personal data. Mulla Pride challenged the penalty, arguing, among other things, that the regulator had not adequately addressed its responses to the earlier enforcement notice.

In July 2025, the High Court dismissed the company’s constitutional petition with costs. The key point, however, requires precision: the court held that Mulla Pride had used the wrong legal procedure and should have pursued the statutory appeal route under section 64 of the Data Protection Act. It did not determine every substantive challenge to the penalty on its merits.

That distinction is important. The decision reinforces the need to challenge regulatory decisions through the procedure established by law. It should not be presented as a blanket judicial endorsement of every ODPC decision or as a ruling that removes the regulator’s obligation to act fairly.

The wider signal remains significant. A regulated business cannot assume that contesting an enforcement action will make it disappear. Equally, a regulator’s authority must be exercised within the law, with defensible reasoning and proper procedural safeguards.

For businesses, the lesson is that data protection has become a governance issue, not merely a privacy-policy exercise. For the ODPC, the challenge is to ensure that its decisions remain legally robust as scrutiny increases.

The ODPC’s record provides evidence of an increasingly active enforcement system. In an account of its achievements published around the fifth anniversary of the Data Protection Act’s implementation, the regulator reported that it had registered 7,223 data handlers, reviewed 138 data-protection impact assessments, issued 192 advisories, conducted 58 audits and inspections, received complaints, issued 68 determinations, served 68 enforcement notices, issued 11 penalty notices and resolved 21 cases through alternative dispute resolution.

Those figures are useful, but they are a snapshot of reported activity rather than a complete, current scorecard for 2026. They should not be combined casually with newer figures published by private law firms, which may use different reporting periods or definitions.

More fundamentally, the number of notices or penalties is not a direct measure of how much safer people’s data has become.

A determination records a decision. An enforcement notice requires corrective action. A penalty notice imposes a financial sanction. Compensation addresses harm suffered by a data subject. An audit tests compliance. These instruments serve different purposes, and one case may involve more than one of them.

A stronger measure of progress would show how many organisations complied with enforcement notices, how quickly complaints were resolved, how often penalties were collected, how many affected people received compensation, and whether repeat violations declined.

Without that information, a growing enforcement count can demonstrate regulatory activity without proving that unlawful practices are being deterred.

Data-protection enforcement is not just about the final decision. It is a process that begins when a person identifies a possible violation and continues through investigation, determination, appeal and, where applicable, compliance or compensation.

For a complainant, the practical questions are straightforward: Can the complaint be filed and investigated without unreasonable delay? Does the decision explain what happened? Is corrective action taken? If compensation is ordered, does the person receive it?

For a business, the questions are equally consequential: Is the scope of an investigation clear? Can the organisation respond to the evidence? Are the reasons for a decision documented? Is there a meaningful route to challenge it?

The Mulla Pride litigation highlights why both sides matter. Strong regulation and due process are not opposing goals. Fair procedures help ensure that decisions can withstand scrutiny and that enforcement retains public legitimacy.

The ODPC has also been building the systems through which its mandate is delivered. In July 2026, it announced the launch of an ISO 9001:2015 quality-management system intended to improve operational consistency, accountability and service delivery across functions including complaint resolution, audits and enforcement. The initiative was supported through the World Bank-backed Kenya Digital Economy Acceleration Project.

That is a potentially useful institutional step. Its value will ultimately depend on measurable results: shorter resolution times, clearer communication, consistent decisions and better follow-through.

Complaints are only one route through which organisations face scrutiny. Compliance audits can help identify systemic weaknesses that may not be visible in an individual complaint.

The ODPC’s compliance-audit framework provides a route for examining how organisations collect, store, share and protect personal information. In practice, this makes the quality of internal records increasingly important: an organisation should be able to explain what data it holds, why it holds it, who can access it, which third parties receive it and when it will be deleted.

For digital lenders, the risks can involve the use of customer contacts or information obtained from third parties in debt collection. For healthcare providers, they may concern access to sensitive patient records. For employers and schools, they can involve employee information, student records, images or monitoring systems. For technology companies, they may extend to profiling, automated decision-making and transfers of personal data to overseas service providers.

These are not identical compliance problems. But they share a common principle: possessing data does not grant an organisation unlimited permission to use it.

The business case for compliance is therefore changing. The cost of maintaining appropriate controls must be weighed against the potential consequences of unlawful processing, including regulatory action, compensation, litigation, remediation costs and reputational damage.

Yet audit powers only deliver value if the regulator can deploy them effectively. Risk-based selection, clear audit procedures, technically capable staff and proportionate follow-up will matter as much as the existence of the rules themselves.

The Data Protection Act already gives the ODPC enforcement powers. Section 63 provides for administrative penalties of up to KSh5 million or 1% of an undertaking’s annual turnover for the preceding financial year, whichever is lower. The law also provides for enforcement notices and other remedies, subject to the applicable statutory requirements.

That ceiling creates a question about deterrence, particularly where an organisation processes data at substantial scale. A fixed maximum may carry different weight for a small company than for a large financial institution or digital platform.

A Data Protection (Amendment) Bill has been discussed in legal and compliance commentary, including proposals concerning penalty calculations and broader obligations. But a proposed amendment must not be mistaken for a change in the law already in force. The precise legislative status and text of any proposal should be confirmed against current parliamentary records before attributing a new penalty formula or additional obligation to Kenya’s legal framework.

Increasing penalties, on its own, would not guarantee better protection. A credible deterrent depends on the likelihood of detecting a violation, the quality of the investigation, the consistency of decisions and the probability that a sanction will be enforced.

A larger maximum fine that is rarely applied, poorly explained or difficult to collect may have less practical effect than a proportionate penalty backed by predictable enforcement.

The policy choice is therefore broader than whether to increase the number on the statute book. Kenya must decide how to make penalties effective, proportionate and procedurally sound and how to ensure the regulator has the capacity to apply them.

The ODPC’s mandate spans a fast-growing digital economy. It must engage with traditional organisations as well as cloud services, digital-credit platforms, biometric systems, artificial intelligence and cross-border data processing.

Each brings different technical and legal questions. Assessing whether a company has a privacy policy is not the same as evaluating whether its automated system creates risks for individuals, whether its security controls are adequate or whether a transfer of sensitive information is lawful.

The regulator’s ability to respond depends on staffing, specialist expertise, sustainable funding, technical tools and access to the evidence needed to investigate complex cases. It also depends on the ability to prioritise: not every administrative shortcoming carries the same risk as the unlawful exposure or misuse of sensitive personal data.

This is where enforcement statistics need to be matched with institutional transparency. Public reporting should distinguish complaints received from those resolved, explain the status of enforcement notices, provide context for penalties and compensation, and report on compliance after decisions are issued.

Publishing clear, comparable statistics would allow the public to assess not only how much the regulator does, but what changes because of its work.

For the ODPC, the next phase should be measured against a small number of concrete outcomes:

• Faster, more transparent complaint resolution. Publish clear reporting on timelines, backlogs, outcomes and routes of appeal.

• Evidence of compliance after enforcement. Report on whether organisations implement corrective measures and whether violations recur.

• Proportionate and consistent sanctions. Explain how relevant factors shape penalties and how the regulator balances deterrence with procedural fairness.

• Better institutional capacity. Demonstrate how staffing, technical expertise, systems and funding translate into stronger investigations and public service.

• Clearer public guidance. Help individuals understand their rights and help organisations identify their obligations before harm occurs.

• Attention to emerging risks. Build the expertise needed to supervise automated decisions, biometric processing, complex vendor arrangements and international data flows.

Businesses, meanwhile, should not wait for an audit or complaint before reviewing their practices. They need accurate records of processing activities, documented lawful bases, appropriate security controls, clear arrangements with third-party processors and tested procedures for handling data-subject requests and breaches. Where high-risk processing is involved, they should assess the risks before deployment and document the safeguards adopted.

Compliance should be treated as an ongoing operational responsibility, not a registration certificate or a policy document that sits untouched after it is approved.

Kenya has established a legal framework, a functioning regulator and a growing record of enforcement. The ODPC’s actions, the litigation surrounding its decisions and the development of compliance-audit systems all point to a data-protection regime with real consequences for organisations that mishandle personal information.

But a watchdog’s strength cannot be measured solely by the size of its penalties or the number of notices it issues.

The more meaningful test is whether people can obtain remedies, whether organisations change their behaviour, whether decisions withstand legal scrutiny and whether the regulator can carry out its mandate consistently across a complex economy.

The next chapter of Kenya’s data-protection story should therefore focus on more than stronger statutory powers. It should focus on stronger implementation, transparent performance and demonstrable outcomes.

The ODPC has teeth. The question now is whether it can use them consistently, and whether the system around it will give those teeth the reach, resources and legitimacy needed to protect the public.