ODPC Case Digest
What the Commissioner has actually decided.
We are building a structured digest of published ODPC determinations. Each digest separates the material facts, determination and legal significance rather than treating a regulator's determination as ordinary High Court precedent.
ODPC/COMP/1966/2024 · 2025
Kennedy Omondi Ochieng v Fingrow Capital Limited
Material facts
The complaint concerned the disclosure of confidential financial and identity information in the course of debt collection. The determination records allegations concerning contact with third parties and disclosure of documents including payslips, bank statements and identification information.
Determination / outcome
The ODPC found unlawful disclosure/processing and ordered Fingrow Capital Limited to pay KES 200,000 in relation to the complaint.
Why it matters: Debt collection does not create a blanket licence to disclose a borrower's personal information to third parties.
Official determination index ↗
ODPC/COMP/1679/2024 · 2025
Brian Githaiga v NCBA Bank Kenya Ltd
Material facts
The complainant alleged that an incorrect email address remained associated with his account despite requests for correction, resulting in transaction information being sent to an unintended recipient.
Determination / outcome
The ODPC found NCBA liable for violating the complainant's right to erasure. The bank was ordered to remove the incorrect third-party email address within 14 days and to pay KES 250,000 compensation.
Why it matters: Accuracy and timely response to rectification/erasure requests are operational obligations, not merely policy statements.
Official determination index ↗
ODPC/COMP/1655/2024 · 2025
Antony Mwenda v Ceres Tech Limited t/a RocketPesa
Material facts
The complaint concerned loan-related contacts where the complainant disputed having taken the loan and alleged that his personal information had been used in connection with the facility. The investigation examined the respondent's records and the handling of the complainant's data.
Determination / outcome
The ODPC found violations concerning the complainant's right to be informed and right to object, unlawful processing and the provision of false information during the investigation.
Why it matters: A regulator's investigation creates its own evidential duties; inaccurate or misleading information supplied to the Commissioner can materially aggravate the regulatory position.
Official determination index ↗
ODPC/COMP/0403/2025 · 2025
Eric Mutune v Rosky Credit Ltd
Material facts
The complaint concerned an unsolicited marketing message. The respondent maintained that the complainant had provided his details during a marketing interaction and that the communication was limited.
Determination / outcome
The ODPC found a breach of the complainant's right to be informed under section 26(a) of the Data Protection Act and ordered compensation of KES 20,000.
Why it matters: Direct marketing compliance involves transparency and lawful processing obligations; a business should not assume that a single communication is automatically outside data-protection requirements.
Official determination index ↗
ODPC/COMP/1500/2025 · 2026 publication
Arthur V.O. Opinya & others v Brainstorm Insurance Brokers Limited
Material facts
The matter is one of the determinations published by the ODPC in 2026. The official determination is the primary source for the complaint facts, issues, findings and orders.
Determination / outcome
This entry is intentionally retained as a primary-source-linked record pending extraction and verification of the full determination text. The site does not invent a holding where the underlying PDF has not yet been independently digested.
Research status: Published determination identified; full digest pending verification.
Read the ODPC PDF ↗