Compliance Decoder
What Kenyan data protection and compliance rules require, in plain language. Each issue is drawn from ODPC determinations and court decisions, and every claim is cited to its source. New issues go out in The Resilient Business Brief.
Issue 2, 22 September 2026
Your customer paid by M-Pesa. That's not a marketing list.
Whitepath and Regus were fined KES 5 million each for the same root mistake: reusing a number collected for one purpose to market for another.
Issue 1, 15 September 2026
Can you prove your customer said yes?
The burden of proving consent sits with the business, not the customer. What a consent log needs to hold, with citations to ODPC and court decisions.
Not sure where to start? Start with the scorecard.
Eighteen questions, about five minutes. You see your score and your three weakest areas without giving an email address.