Office Of The Data Protection Commissioner Imposes Its First Fine Under The Kenya Data Protection Act

Recent Developments

Approximately two years following its operationalisation, the Office of the Data Protection Commissioner (ODPC) has begun taking enforcement action against data controllers and data processors.

On 21 December 2022, the ODPC announced that it issued its first penalty notice under the Data Protection Act, 2019 (DPA) against Oppo Kenya, imposing a fine of KES 5 million (approximately USD 41,000), which is the highest penalty that can be imposed under the DPA. The penalty notice was preceded by an enforcement notice issued on 3 November through which the ODPC had directed Oppo Kenya to review some of its data handling practices following a complaint by a data subject whose photo was used on Oppo Kenya's Instagram account without consent.