ODPC Compensation Awards Face New Test After Court Query

In Short

Kenya’s Office of the Data Protection Commissioner (ODPC) is facing a legal challenge over whether it can decide how much money businesses should pay individuals as compensation for privacy violations.

What Happened

The High Court questioned whether the ODPC can independently determine damages payable to individuals. This is despite the Data Protection Act giving affected people a right to seek compensation.

The ruling could give companies a new legal argument when they contest compensation awards issued by the regulator. The decision does not invalidate previous awards, but it raises questions about the legal authority used to issue them.

TechTrendsKE previously reported that more than KSh30 million had been paid to individuals during 2025 following data protection violations. Reported cases included alleged mishandling of customer information, use of personal photographs without consent, and continued direct marketing after individuals objected.

The ODPC’s compensation decisions have affected businesses in sectors including financial services, healthcare, lending, and digital commerce.

Examples cited include Standard Investment Bank being ordered to pay Andrew Endovo KSh50,000 after sending an unsolicited promotional email without his consent. Platinum Credit was ordered to compensate Philip Bolo KSh900,000 after continuing direct marketing communications despite his objection.

Moja Expressway Company was ordered to pay former employee Cyrus Mwaniki Ndung’u KSh500,000 for using his photograph to promote electronic toll collection services without his permission. Tech Limited also received a KSh2.6 million compensation order, which it later challenged at the High Court.

Why It Matters

If the ODPC’s power to set compensation amounts is limited, businesses could have stronger grounds to challenge monetary awards.

For companies that handle personal data, the issue goes beyond fines. It affects compensation exposure, which can be a material cost when enforcement actions are upheld.

For individuals, the ruling could shape how compensation for privacy harms is pursued, even where the Data Protection Act recognises the right to seek it.