ODPC Issues 184 Compensation Orders to Data Protection Complainants: A Milestone for Privacy Rights in Kenya | Dawan Africa
Publish Date: 2026-01-26 04:44:00
Source Domain: www.dawan.africa
Kenya, January 26, 2026 – The Office of the Data Protection Commissioner (ODPC) has issued 184 compensation orders to Kenyans whose personal data was mishandled, marking one of the strongest enforcement moves under the Data Protection Act, 2019 since its enactment.
The orders come after thousands of complaints were lodged over breaches of individuals’ privacy rights. Since the law came into force, the ODPC has received 9,061 data protection complaints, of which 84 disputes were resolved through Alternative Dispute Resolution (ADR) and 357 determinations, 134 enforcement notices and 20 penalty notices have been issued to promote compliance with data protection rules.
The Data Protection Act, 2019, gives effect to Kenya’s constitutional right to privacy and sets out rules on how personal data should be collected, processed, stored, and shared by both public and private organisations.
It is designed to protect individuals from misuse of their personal information while ensuring organisations handle data responsibly. Under the law, individuals are empowered with several rights. They have the right to be informed about how their data is being used, giving them transparency and control over their personal information.
They can also access and correct any data held about them, ensuring accuracy in records that affect their personal or professional life. Additionally, the Act allows individuals to object to the processing of their data in cases where they do not consent to certain uses, and to request the deletion of information that is inaccurate, irrelevant, or unlawfully collected.
These provisions make privacy protection enforceable and give citizens practical tools to safeguard their personal information. Under the Act, entities that breach data protection requirements can face fines of up to Sh5 million, imprisonment for up to 10 years, or both, and data controllers and processors must register with the ODPC before handling personal data.
The compensation orders…
