What This Office Does
The ODPC enforces Kenya's Data Protection Act 2019. It protects your right to control how your personal information is collected, stored, shared, and used — by companies, government agencies, and individuals.
Relevant Laws
- Constitution of Kenya 2010 — Article 31 (Right to Privacy)
- Data Protection Act No. 24 of 2019
- Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021
Who Can Use It
Any person whose personal data has been collected, shared, or used without consent or in violation of the Data Protection Act.
Problems It Handles
- A company shared your information without your permission
- Your data was collected without telling you why
- You asked for your data to be deleted and were ignored
- Your information was used for a purpose you never agreed to
- A data breach exposed your personal details
- Your M-Pesa data, medical records, or ID details were misused
How to Complain
- 1
Visit odpc.go.ke and click "File a Complaint" — online, by email, or in person.
- 2
Provide your name, contacts, and the name of the organisation you are complaining about.
- 3
Describe what they did with your data and any steps you have already taken.
- 4
Attach supporting documents — screenshots, emails, messages.
- 5
Filing is free of charge.
What to Expect
The ODPC can order the organisation to stop unlawful use of your data, delete your information, or impose a penalty. You can appeal decisions to the High Court within 30 days.
What It Cannot Do
- Cannot handle general privacy complaints not involving personal data
- Cannot award you direct financial compensation
- Cannot act on complaints older than 3 years in most cases
Tip
Take screenshots immediately when you discover misuse. Save any emails or notifications that show what happened and when.