Corporates hit amid mounting data breaches

In 2025, the Office of the Data Protection Commissioner put real weight behind Kenyans’ digital rights, awarding over Sh30 million to individuals whose complaints over data protection violations were upheld.

We take a look at some of the highest compensation paid out from rulings upheld in 2025.

Philip Bolo Vs Platinum Credit Complaint: Promotional calls and text messages

Award: Sh900,000

Mr Bolo wrote an email to Platinum Credit requesting that it stops sending him unsolicited texts and calling him to promote their loan products, but the creditor ignored the requests.

Mr Bolo then made a call asking the creditor to delete his personal data from its database, but to no avail. He continued to receive calls from different sales agents of Platinum Credit.

In its response, Platinum denied that the phone numbers used to contact Bolo belonged to any of its sales agents or were associated with the company.

Platinum claimed that people were masquerading as its employees, while some were its former employees who left with ill motives to damage the company’s reputation.

However, on one of the calls made by the sales representative, Platinum reached out to Mr Bolo and apologised for the unsolicited call. Platinum maintained that at all times it sought express consent to use individuals' personal data for its promotional activities.

However, it failed to prove that it obtained consent from Mr Bolo who had prayed for Sh1 million as compensation for the disturbance caused.

Richard Wafula Vs Hotel Tobriana Complaint: Wedding image and video use

Award: Sh750,000

Mr Wafula filed the complaint, accusing the hotel of using his wife’s and their guests' images and video taken during their wedding at the establishment for advertising.

Mr Wafula told the Data Commissioner that the hotel shared its wedding content in branded and personalised advertisements on its social media platforms, Facebook and Instagram, without seeking his wife’s consent.

He had sought Sh2.5 million in compensation, but the Data Commissioner awarded Sh750,000, faulting the hotel for not only failing to seek express consent, but also for refusing to delete the images and video from its social media accounts.

Benjamin Ouma Vs St Joseph International Science School Complaint: Billboard image use of a minor 

Award: Sh700,000

Mr Ouma filed the complaint on behalf of a minor (KDA) whose image was used on a billboard advert paid for by the school. He claimed that the minor had gone for a fun day at school when the children were lured to put on uniforms and their photos taken.

According to Mr Ouma, KDA was not a student of the school and accused the institution of infringing on the minor's privacy for financial gains without compensation.

Awarding the compensation, the Data Commissioner faulted the school for failing to obtain consent for the image from the minor’s parents.

Ferdinard Omanyala Vs Oygene Marketing Communication Complaint: Image use

Award: Sh500,000

The fastest man in Africa filed the complaint in October 2024, accusing the PR and marketing firm of using his image to advertise its work on its website without seeking his approval.

The firm had initially approached Mr Omanyala on behalf of its client Safaricom, seeking to on-board him for a project known as ‘Making of A Star.’

However Mr Omanyala says along the way, due to irreconcilable differences, he declined to be part of the project and requested that Oxyene erase the personal data he had initially shared with them when they first reached out regarding the project to them.

He would, however, later come across a poster with his image posted by Oxygene advertising the Safaricom project. Mr Omanyala sought compensation of Sh10 million.

In defense, Oygene argued it had interviewed several athletes for the project, including Mr Omanyala, who had willingly and voluntarily shared his data with the agency during the interview.

Oxygene admitted that its employee erroneously and accidentally uploaded the montage. Oxyene wrote an apology when Omanyala’s advocate wrote accusing it of breach of brand rights, copyright, trademark rights and invasion of privacy.

The Data Commissioner declined to award the Sh10 million Omanyala had prayed for, noting that Oxyegene had issued an apology and pulled down the post.

The Commissioner noted that Sh500,000 was fair compensation for the use of his personal data without having given his express approval.

Yasin Abkar Vs Wananchi Group (Zuku) Complaint: Erasure of personal data

Award: Sh500,000

Mr Abkar had ceased being an employee of Zuku. However, Zuku continued sending him promotional messages, despite his verbal, phone, and even email requests to the company to delete his personal information from its systems and database.

In defence, Zuku argued that it had conducted a comprehensive review of its record and its system and found out that there was no formal data deletion request from Mr Abkar.

However, ODPC noted that Mr Abkar had presented an email he wrote to Zuku requesting that the company stop sending him unsolicited communication and delete his personal data from its system.

Mr Abkar's email was undelivered, and the Data Commissioner faulted Zuku for providing an invalid and non-operational email address on its website.

Vincent Muema Vs Sinoma Roofing Complaint: Image Use

Award: Sh50,000

Muema accused Sinoma Roofing of using his image to market its products on social media without his approval. Sinoma posted photos of Muema on its official Facebook and Instagram social media handles to advertise its upcoming workshop event.

Muema told the Data Commissioner he was never informed that his image was to be used for the social advertisement. Sinoma didn’t file a response.

Marlene Ngina Vs Whitepath Ltd Complaint: Calls and text over defaulted loan

Award: Sh450,000

Ms Ngina filed the complaint following several calls that had become a nuisance, she had received from Whitepah over a defaulted online loan taken by her colleague.

Marlemne said Whitepath repeatedly called her and sent her texts using different numbers over the loan, arguing that the act violated her privacy.

The calls from Whitepath demanded that she reach out to her colleague and ask her to settle the loan. Whitepath maintained that if her colleague didn't settle the loan, Ms Ngina would be the one to pay it as she had been listed as a guarantor.

Ms Ngina stated she didn't have any prior knowledge of the loan and hadn't signed anywhere to be a guarantor of the same. She also stated that she hadn't shared her data with Whitepath. Whitepath chose not to file a defence.

Ayub Odanya Vs Geosky Ltd Complaint: Use of his CV

Award: Sh450,000

Ayub, a lecturer at Nairobi University, filed the complaint after the directors of Geosky Ltd used his personal data, including his CV, professional certificates and other academic certificates, to submit a tender at the Central Bank of Kenya.

Ayub told the Data Commissioner that he had professional dealings and connections with one of the Geosky directors, which led to the obtaining of his documents that were fraudulently used to submit the tender in the pretence that they belonged to the director. Geosky didn't file a response. The lecturer had prayed for Sh5 million compensation.

Samuel Kamau Vs Platnum Credit Complaint: Promotional Calls

Award: Sh400,000

Mr Kamau filed the complaint after receiving an unsolicited call promoting a loan product from a sales representative of Platinum Credit.

Kamau noted that while engaging with the sales representative he had never met before, on the call, he discovered that the representative had had access to his personal identifiable information, including specific details of his vehicle.

When he questioned the representative on the source of his personal data, the sales representative stated that the management routinely shared such information with the sales team for them to contact and promote the company’s product to potential clients.

In its defence, Platinum denied the phone number used to contact Mr Kamau belonged to any of its sales agents or was associated with the company.

When Mr Kamau complained, the sales representative was asked to start working from home to avoid being found on the Platinum Credit premises during investigations.

The investigations subsequently found Platinum guilty of illegally processing Mr Kamau’s personal data for commercial interest.