Be able to prove you handle personal data lawfully

What goes wrong

Most businesses collect customer phone numbers, ID copies and payment details without a record of why they hold them or what the customer agreed to.

The usual trigger for trouble is ordinary: a marketing message sent to a number taken from an M-Pesa payment, or a former customer who keeps receiving offers.

What it costs the business

The Commissioner can award compensation to the person who complained and impose penalties of up to KES 5 million or 1% of annual turnover, whichever is lower.

Banks and larger clients now ask suppliers for evidence of data protection compliance before they sign.

What we do

• Registration

  Registration with the Office of the Data Protection Commissioner as a data controller or processor, where the law requires it.

• Data mapping

  A record of what personal data you hold, where it sits, why you hold it and who can reach it.

• Consent and notices

  Consent wording, privacy notices and a consent log that would stand up to a complaint.

• Impact assessments

  Data protection impact assessments for new systems and for processing the law treats as high risk.

• Breach procedure

  A written procedure that meets the 72-hour notification window, with the person who runs it named.

• Data protection officer support

  An outsourced data protection officer function for businesses that need one and cannot justify a full-time hire.

From the Compliance Decoder

Our series on what the law requires, drawn from decided cases.

• Issue 2, 22 September 2026

  Your customer paid by M-Pesa. That's not a marketing list.

  Whitepath and Regus were fined KES 5 million each for the same root mistake: reusing a number collected for one purpose to market for another.

• Issue 1, 15 September 2026

  Can you prove your customer said yes?

  The burden of proving consent sits with the business, not the customer. What a consent log needs to hold, with citations to ODPC and court decisions.