When a customer's personal data is misused, the first question is usually the familiar one: who is to blame?
Lawyers look at the policy. Compliance teams look at the paperwork. But in many recent cases before Kenya's Office of the Data Protection Commissioner (ODPC), the real answer sits somewhere less obvious. It sits in the product itself.
These were not cases of intelligent attackers overcoming defenses. It was about how the email address had been dealt with improperly, about how the customer kept receiving unwanted marketing emails, and how his information had never been rectified. Ordinary product decisions, with expensive consequences.
The ODPC's record shows how seriously the Data Protection Act, 2019 is now being applied. By January 2026, the office had issued 184 compensation orders, alongside 357 determinations, 134 enforcement notices and 20 penalty notices. Organisations that breach the Act can face fines of up to KSh 5 million, imprisonment of up to 10 years, or both.
To software engineers, product managers, CTOs and CEOs, here’s what it means. Compliance is no longer something to add after launch. It is built, or broken, in the code.
The Violation Started in the Product
Consider three recent ODPC outcomes.
NCBA Bank was ordered to pay KSh 250,000 after a customer's email address was mishandled, resulting in repeated disclosure of confidential business information to an unintended recipient. Technically, this is a contact-data problem: weak verification of who owns an address, and no safeguard to stop sensitive messages from reaching the wrong inbox.
Platinum Credit Limited was ordered to pay KSh 400,000 for unlawfully processing a customer's personal data and subjecting him to persistent unsolicited marketing. The ODPC also issued an enforcement notice directing the lender to stop all unlawful processing. This is a consent and opt-out problem. If a system cannot prove permission, or cannot honour a request to stop, the system itself is the violation.
In that same matter, the ODPC found the lender had failed to correct the complainant's data despite having adequate time and opportunity to do so. This is a workflow problem: a correction request with no owner, no deadline and no tracking will eventually become a complaint.
Moreover, Diamond Trust Bank Kenya and Uganda operations incurred a fine of KSh 500,000 for failing to adhere to data protection laws in November 2025. In both cases, the institutions and facts may be different; however, the common element remains. The institutions and facts differ, but the thread is the same. Regulators are no longer asking only whether a policy exists. They are asking whether the systems actually do what the policy says.
Privacy by Design is a Legal Responsibility, Not an Option
Under Kenya's Data Protection Act, an organisation is obligated to design and implement privacy by design and by default. What this means is that engineers' decisions on what to collect, how long to keep it, who gets access to it, and how users withdraw their consent during every sprint have legal implications.
Going through an internal procedure does not necessarily absolve you of all legal responsibility if the procedure does not take into consideration potential risk. "Just-in-case" data collection, no-consent mailing lists and tools that allow agents to export user records without restriction can pass initial tests but will not withstand further scrutiny by the regulators.
The enforcement net is also widening. More than 15,000 entities now hold ODPC registration certificates, and in August 2026 the ODPC gave organisations with expired certificates 14 days to renew. The regulator knows who is processing data, and it is checking.
5 Questions Every Development Team Must Ask Before Launching
1. Are we collecting only what we need? More fields mean more risk. If a feature doesn’t require personal information to work, don’t collect it.
2. Are consent records and withdrawals possible? Consent records should be complete and include when and how consent was obtained. Opt-out should be easy and real, just like opt-in.
3. Is correction and deletion of data possible on request? A data subject request should have its owner, clear procedures and deadlines. It shouldn’t be an open-ended discussion by email that no one will ever finish.
4. Who can access personal data, and is access tracked? Role-based access and logging will change “we think nobody saw it” to “here is exactly who saw it.”
5. Are we capable of detecting the breach and informing the ODPC in 72 hours? The Act gives organisations a small window after becoming aware of a data breach to inform the ODPC. An effective monitoring mechanism and incident response plan have to be in place beforehand.
This Is Not Just a Banking Problem
It would be easy to read these cases as stories about banks and lenders. They are not. A SaaS provider, an online retailer, a hospital, a logistics software, a school management portal, or any organization handling personal information from individuals in Kenya is subject to the same regulations.
The involvement of third-party tools intensifies the responsibility even further. Analytics software, SMS gateway providers, payment gateways, and cloud services may all process the data of customers, but it is the company collecting the data that remains responsible. With the rise of IoT systems and other evolving technologies, the ODPC's Guidance Note on Emerging Technologies, which closed for comments in August 2026, highlights the areas of concern for regulators.
What Every Organisation Should Do Now
Every organisation should treat these cases as an opportunity to ask difficult questions before the regulator does.
Do our developers and product owners understand their data protection duties?
Have we completed a Data Protection Impact Assessment for our newest feature or system?
Could we respond to a data subject request this week, not this quarter?
Is our ODPC registration valid and up to date?
Do our legal, engineering, product and customer support teams work together, or in silos?
These questions are no longer optional.
Conclusion
The increasing number of compensation orders, notices and penalties issued by the ODPC is indicative of more than just an increasingly strict regulator. It shows what is becoming expected of organizations that process customer information. Customers do not judge a company just by its services, but by the manner in which it handles their information.
For software teams and the leaders who guide them, the lesson is clear. Data protection is not a document to file or a checkbox to tick. It is a design decision made again with every feature, every integration and every release.
Because in today's digital economy, the organisations that earn trust will not be those that never face scrutiny. They will be those whose systems were built to protect people long before anyone asked.
Could your product pass a data protection audit today?
Let's talk.
📞 Telephone: +254 728223333 | +254 717335467
📧Email: digitalsupport@southendtech.co.ke | info@southendtech.co.ke | dataprotection@southendtech.co.ke
South-End Tech Limited — Helping businesses build visible and Cyber-resilient Enterprises.