One-hundred and eighty-four Kenyans are poised to be compensated following breach of their personal data, this is according to the Office of the Data Protection Commissioner (ODPC).
The ODPC said it has issued 184 compensation orders to Kenyans affected by data breaches since the enactment of the Data Protection Act, 2019 (DPA).
Out of 9,061 complaints received by the Commissioner, the office has also successfully resolved 84 cases through the Alternative Dispute Resolution (ADR) framework.
The DPA, enacted to give effect to the right to privacy under Article 31(c) and (d) of the Constitution, is Kenya’s primary law governing the collection, processing, and protection of personal data.
In the laws, Kenyans have the right to be informed about how their data is used, access their personal information, object to processing, and request the correction or deletion of inaccurate data.
The Act also demands that data controllers and processors mandatorily register with the ODPC and comply with specific obligations before and after registration.
In the laws, entities or establishments that break the law risk fines of up to Sh5 million, imprisonment of up to 10 years, or both.
“The ODPC has taken swift action on these complaints, issuing 357 determinations, 134 enforcement notices, and 20 penalty notices to ensure compliance with data protection regulations,” Data Commissioner Immaculate Kassait said ahead of the 2026 Data Privacy Day Conference in Mombasa.
Kassait announced that the regulator has expanded its footprint to better serve Kenyans, with regional offices in Nairobi, Mombasa, Kisumu, Nakuru, Eldoret, Machakos, Garissa, and Nyeri.
“In 2024, we launched our second strategic plan for 2025–2029, focusing on strengthening data protection policies and regulations, enhancing institutional capacity, and increasing compliance with data protection laws,” she said.
She went further to indicate that the Compliance and Inspection Directorate has issued registration certificates to more than 15,000 entities, signalling adherence to data protection requirements.
The DPA gives the Office of the Data Commissioner the power to impose administrative fines for failure to comply with the DPA.
The Office of the Data Commissioner may impose a fine of up to Sh5 million or, in the case of an undertaking, up to 1 per cent of its annual turnover of the preceding financial year, whichever is lower. The fine is payable to the Office of the Data Commissioner.
Failure to comply with an order of the Office of the Data Commissioner is considered an offence under the DPA. Section 65 of the DPA accords all data subjects the right to compensation from data processors or controllers for damage caused to them.
Under the regulations, obtaining access to personal data without the prior authorisation of the data controller or processor holding the data.
“Disclosure of personal data to a third party without prior authorisation by the data controller or processor holding the data,” notes the regulations.
There is also the prohibition of the sale of personal data obtained unlawfully. It clarifies as well that advertising the sale of such data constitutes an offer to sell under this offence.
