Court casts doubt on ODPC's power to order businesses to compensate privacy victims
Kenya’s data protection enforcement framework is facing a legal test over the authority to impose financial compensation on businesses found responsible for privacy violations. The High Court has questioned whether the Office of the Data Protection Commissioner (ODPC) can independently determine damages payable to individuals, even though the Data Protection Act gives affected persons a right to seek compensation.
The decision could give companies a new legal argument when contesting monetary awards issued by the regulator. It comes after the ODPC developed a record of financial enforcement against organisations handling personal information, with compensation claims becoming a material part of its work.
TechTrendsKE reported in January 2026 that more than KSh30 million had been paid to individuals during 2025 following data protection violations. The cases involved businesses accused of mishandling customer information, using personal photographs without consent and continuing direct marketing after individuals had objected.
The High Court’s decision does not invalidate those previous awards. However, it introduces a question about the legal authority through which the Commissioner has been issuing them.
The financial consequences of Kenya’s data protection enforcement
The ODPC’s compensation decisions have affected businesses across several sectors, including financial services, healthcare, lending and digital commerce.
Among the cases reported by the regulator, Standard Investment Bank was ordered to pay Andrew Endovo KSh50,000 after sending him an unsolicited promotional email without his consent. Platinum Credit was ordered to compensate Philip Bolo KSh900,000 after continuing direct marketing communications despite his objection.
Moja Expressway Company, which operates the 27-kilometre Nairobi Expressway, was ordered to pay former employee Cyrus Mwaniki Ndung’u KSh500,000 for using his photograph to promote electronic toll collection services without his permission. Tech Limited also faced a KSh2.6 million compensation order, which it subsequently challenged at the High Court.
These cases illustrate the financial exposure organisations face when their handling of personal information falls short of the requirements established by the Data Protection Act.
The regulator’s enforcement record predates the latest compensation disputes. In an April 2025 analysis, TechTrendsKE reported that the ODPC had issued 51 determinations in 2024, with average fines of approximately KSh522,308 per case.
Those administrative fines serve a different purpose from compensation awarded to individuals. The distinction is central to the latest court decision because the judge questioned whether the Commissioner can exercise both the regulator’s enforcement functions and the authority to determine damages payable to an affected person.
High Court questions the legal basis for compensation awards
Justice Francis Andayi set aside a KSh1.25 million compensation award issued against a Nairobi healthcare business following a complaint involving CCTV cameras installed in a clinical examination room.
The patient, identified as GW, argued that the cameras compromised her privacy. The healthcare provider disputed the ODPC’s findings and presented forensic evidence concerning the footage.
The High Court did not determine whether the alleged privacy violation occurred. Instead, it examined whether the Commissioner had the legal authority to order the business to compensate the complainant.
The dispute centred on the relationship between Section 65 of the Data Protection Act and Regulation 14(3)(e) of the subsidiary legislation.
Section 65 provides a right to compensation for individuals who suffer damage because of a contravention of the Act. However, Justice Andayi observed that the provision does not expressly assign the Commissioner the responsibility of determining whether damage has occurred or calculating the compensation payable.
The judge distinguished between the regulator’s authority to investigate complaints, impose administrative penalties and issue enforcement notices, and the separate function of deciding monetary claims between parties.
In his interpretation, the Act expressly establishes the Commissioner’s enforcement powers but does not provide an equivalent explicit grant of authority to award damages.
The judgment also questioned whether Regulation 14(3)(e) could introduce a substantive power that Parliament had not expressly provided for in the parent legislation.
The legal principle relied upon by the judge was that statutory agencies and tribunals can exercise only powers conferred on them by law. A regulation cannot independently create substantial jurisdiction beyond the authority granted by the enabling Act.
Why the distinction between penalties and damages matters
The judgment goes beyond statutory interpretation. Justice Andayi also questioned the procedure followed when the ODPC issued the compensation award.
The regulator had investigated the complaint, considered the healthcare provider’s response and issued a monetary determination. The judge was concerned that the process had not provided an adequate hearing at which both sides could contest the evidence and address the compensation claim.
He questioned whether the same Commissioner could investigate an alleged violation, effectively prosecute the complaint and then determine the financial remedy without safeguards required by the rules of natural justice.
The judge said the determination of whether an individual had suffered damage following a data protection violation had not been expressly assigned to the Commissioner by the Act.
He also observed that the legal issue required consideration through an appropriate judicial review application or constitutional petition.
“Even if a hearing were to be conducted, I again doubt that it would be by the same Data Commissioner to be the one investigating, then prosecuting it and then deciding. That would be against all the rules of natural justice,” the judge said.
The patient and the Data Commissioner maintained that Section 65, read together with Regulation 14, authorised the watchdog to issue compensation orders. They also relied on previous High Court decisions supporting the regulator’s administrative remedies.
Justice Andayi, however, found that the earlier authorities relied upon had not adequately addressed whether the compensation provision in the regulations exceeded the powers granted under the Data Protection Act.
He declined to strike down Regulation 14(3)(e) or declare all previous ODPC compensation awards unlawful. Such a challenge, he said, required proceedings specifically directed at the validity of the subsidiary legislation, with the Attorney-General given an opportunity to participate.
The decision therefore leaves the regulation in place while exposing its legal foundation to a potential challenge.
Businesses cannot treat the judgment as an automatic cancellation of previous compensation orders. The underlying right of individuals to seek compensation under Section 65 also remains.
Healthcare providers face particular exposure
The dispute comes as the ODPC continues handling complaints involving sensitive medical information and the privacy obligations of healthcare institutions.
In April 2026, the regulator ordered St. Luke Orthopaedic & Trauma Hospital Eldoret to pay Merceline Akoth Odeyo KSh525,000 following a complaint involving the disclosure of medical information.
According to TechTrendsKE’s reporting, the patient received medical test results belonging to another person on two occasions. The complaint also concerned the sharing of her medical information with an external laboratory without her knowledge or consent.
The hospital attributed the incident to human error and argued that the information shared was limited to identification details. The Commissioner found that the hospital had not demonstrated explicit and informed consent or adequately protected the patient’s personal information.
The determination included compensation for emotional distress and the mishandling of sensitive medical data.
The Eldoret case illustrates the financial consequences of privacy failures in healthcare, where organisations process information that can expose particularly sensitive aspects of an individual’s life.
The Nairobi dispute involves a different allegation, concerning surveillance within a clinical examination room. Its outcome, however, introduces a legal issue that extends beyond hospitals to every organisation subject to the Data Protection Act.
Hotels, financial institutions, digital lenders, telecommunications companies and technology businesses all handle personal information and must comply with statutory requirements governing its collection, storage and use.
The ODPC’s ability to investigate complaints and enforce compliance remains intact. The unresolved issue concerns the legal route through which it can determine compensation.
A regulator entering a new leadership period
The legal dispute comes as Kenya’s data protection regulator prepares for a leadership transition following Immaculate Kassait’s six-year tenure as the country’s first Data Commissioner.
In a November 13, 2026 assessment published by TechTrendsKE, Kassait’s record included more than 13,000 complaints handled, 459 determinations issued and 206 enforcement and penalty notice actions. The regulator had also registered approximately 28,000 data controllers and processors.
Kassait has called for amendments to the Data Protection Act to address emerging challenges involving artificial intelligence, sensitive personal information, penalties and data governance. Her proposals also include stronger investigative powers for cases involving organisations outside Kenya and additional time to determine complex complaints.
President William Ruto nominated Lydia Sitienei Chelagat, formerly Director of Legal Services at the Communications Authority of Kenya, to succeed Kassait on November 10, 2026. Her nomination was forwarded to the National Assembly for consideration.
The incoming Commissioner will inherit an institution with a substantial enforcement record and an expanding regulatory mandate. However, the High Court’s examination of compensation powers introduces a legal issue that could influence how the ODPC pursues financial remedies against organisations found to have violated data protection requirements.
For businesses, the judgment provides grounds to scrutinise the statutory basis and procedures behind compensation orders. For individuals, Section 65 continues to recognise the right to seek compensation when personal information is mishandled.
The eventual determination of whether the Commissioner can independently award those damages will depend on a direct judicial examination of the regulation underpinning that authority.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
