Data Privacy in Kenya: That Promotional Message is Likely to Cost You

Introduction

Imagine you are comfortably going about your business at home or in the office. Suddenly, you receive a message from a company marketing its services, offering promotions, or advertising a loan product. You ignore the text, but another message arrives. Then another. Soon the messages become persistent and intrusive.

These unsolicited promotional messages interfere with your peace of mind and raise an important question: what are your legal options?

The Office of the Data Protection Commissioner (ODPC) has recently handled several complaints involving such practices. Two notable cases illustrate how the law protects individuals from unlawful use of personal data.

Case 1: Steve Onwonga Omwenga v CJ’s Limited

In Steve Onwonga Omwenga v CJ’s Limited (ODPC Complaint No. 1498 of 2025), the complainant lodged a case against CJ’s Limited, a well-known restaurant chain, for sending promotional messages without his consent.

Steve reported that he received several promotional messages on different dates in September 2025. After receiving the third message, he contacted the company by email requesting them to acknowledge the unlawful use of his personal data and resolve the matter amicably. However, he received no response.

CJ’s Limited argued that the messages were part of a general promotional campaign and were not sent with malicious intent.

The determination delivered on 2nd January 2026 awarded Steve Kshs. 75,000 as compensation.

Case 2: Mary Ogwena Immaculate v Momentum Credit Limited

In Mary Ogwena Immaculate v Momentum Credit Limited (ODPC Complaint No. 1501 of 2025), the complainant received over 50 unsolicited promotional text messages between February and May 2025.

Mary had never been a customer of Momentum Credit Limited and had never granted consent for her mobile number to be used for marketing purposes. Despite her objections, the messages continued.

Implications for Businesses and Individuals

These determinations signal a significant shift in Kenya’s data privacy enforcement landscape.

For individuals:

• Your personal data is protected under Kenyan law.
• Companies cannot use your data without consent.
• You have the right to seek legal redress for unlawful data processing.

For marketers and businesses:

• Cold messaging, cold emailing, and unsolicited promotional communication may violate data protection laws.
• Personal data may only be used within the limits of the consent granted.
• Failure to comply can lead to significant financial penalties.

Conclusion

Kenya’s data protection regime is becoming increasingly robust. Businesses must ensure that they collect and use personal data responsibly and within the limits permitted by law.

For individuals, these cases reaffirm that privacy rights are enforceable and that unlawful use of personal data may lead to compensation.

For inquiries:
info@wambuigichui.co.ke
wakili.wambuigichui@gmail.com