Send one promotional text too many in Kenya and it can now cost you hundreds of thousands of shillings. Since the Data Protection Act came into force in November 2019, the Office of the Data Protection Commissioner (ODPC) has moved from warnings to real money. By January 2026 it had issued 184 compensation orders to individuals, and many of the best-known cases are about the thing every marketer does: sending messages people never agreed to receive. This report tracks the numbers, the biggest payouts, and the simple habits that keep a business out of the Commissioner’s inbox.
Key findings
The caseload is climbing
Complaints have grown fast as Kenyans learn they can file online for free. The ODPC’s own snapshots show the trend.
ODPC caseload by snapshot
Tap a measure. Figures from ODPC statements; dates are the reporting cut-off.
The payouts: who paid, and why
A penalty notice is a fine paid to the state, capped by the Act at KES 5 million or 1% of annual turnover, whichever is lower. A compensation order pays the person who was harmed. Most marketing cases now end in compensation.
Notable ODPC decisions involving messages and marketing
Tap a case for details. Amounts in Kenya shillings.
One January 2026 report put total payouts by Kenyan firms to individuals in 2025 at more than KES 30 million. We could not check that figure against an ODPC document, so treat it as an estimate.
What the decisions have in common
- No proof of consent. Companies lost when they could not show when and how a person agreed to receive messages.
- Opt-outs ignored. Regus was fined after people kept getting messages despite asking to stop. Zuku was ordered to pay a former customer who was still being messaged.
- Contacts scraped from phones. Whitepath’s app read borrowers’ contact lists and texted their friends and family.
- Data kept too long. Several orders told companies to delete the complainant’s data within a set time, often 14 days.
Is your SMS list complaint-proof?
Ten-point compliance check for SMS marketers
Tick what your business does today. Nothing you tick leaves this page.
This checklist is a starting point, not legal advice. For how Kenya’s scam and spam problem looks from the recipient’s side, see SMS Fraud in Kenya 2026. For the bigger picture of the market, see The State of SMS in Kenya 2026.
Methodology
We compiled ODPC caseload figures from statements by the Data Commissioner and the ODPC’s 2025 Global Privacy Assembly award entry, and case details from Kenyan news reports and law firm summaries. Snapshots have different cut-off dates and are not strictly comparable. We include only cases where the amount and the reason were reported by at least one named outlet. Amounts are as ordered, not necessarily as paid, and some decisions may be under appeal.
FAQs
What is the maximum fine under Kenya’s Data Protection Act?
A penalty notice can be up to KES 5 million or 1% of the business’s annual turnover for the previous financial year, whichever is lower. Compensation orders to individuals are separate.
Can I complain about spam SMS to the ODPC?
Yes. Complaints can be filed online. Keep screenshots showing the sender, the dates and any request you made to stop.
Does a STOP option protect my business?
It helps, but only if it works. Several cases involved people who asked to stop and kept receiving messages. Honour opt-outs fast and keep a record that you did.
Do transactional messages need consent?
Messages needed to deliver a service, such as OTPs and receipts, rest on a different lawful basis from marketing. Mixing promotions into them can turn them into direct marketing.
Sources
- Capital Business, “ODPC issues 184 compensation orders to data protection complainants”, January 2026. capitalfm.co.ke
- Global Privacy Assembly, ODPC Kenya award entry (Dispute Resolution and Enforcement), 2025. globalprivacyassembly.org
- ALN Kenya, “ODPC fines Whitepath, Regus Kenya KES 10 million for data breach”, 2023. aln.africa
- Nation, “Platinum Credit fined Sh400,000 for spamming man with unsolicited SMSs, calls”. nation.africa
- The Kenya Times, “Zuku to pay ex-client Ksh500K compensation for sending him promotional messages”. thekenyatimes.com
- Kenyans.co.ke, “Company ordered to pay Kenyan Ksh700,000 for bombarding him with promotional messages”. kenyans.co.ke
- Business Daily, “Digital lenders, saccos, insurers hit with highest penalties in data privacy woes”. businessdailyafrica.com
- HapaKenya, “ODPC fines DTB Kenya & DTB Uganda Ksh. 500,000 for data privacy breach”, December 2025. hapakenya.com
- TechTrends KE, “ODPC signals tighter privacy enforcement as payouts hit Sh30 million”, January 2026. techtrendske.co.ke
Frequently asked questions
What is the maximum fine under Kenya’s Data Protection Act?
A penalty notice can be up to KES 5 million or 1% of the business’s annual turnover for the previous financial year, whichever is lower. Compensation orders to individuals are separate.
Can I complain about spam SMS to the ODPC?
Yes. Complaints can be filed online. Keep screenshots showing the sender, the dates and any request you made to stop.
Does a STOP option protect my business?
It helps, but only if it works. Several cases involved people who asked to stop and kept receiving messages. Honour opt-outs fast and keep a record that you did.
Do transactional messages need consent?
Messages needed to deliver a service, such as OTPs and receipts, rest on a different lawful basis from marketing. Mixing promotions into them can turn them into direct marketing.