Kenya: Office of the Data Protection Commissioner fined Whitepath Company Limited for breaches of data protection regulations

On 11 April 2023, the Office of the Data Protection Commissioner (ODPC) issued a penalty notice imposing a penalty of KES 5 million against Whitepath Company Limited for non-compliance with an enforcement notice served on 10 January 2023. With nearly 150 complaints received, Whitepath was found to have accessed users' mobile phone contacts and sent unsolicited text messages, as well as harassed complainants and their contacts. Whitepath is required to pay the penalty, as per Section 63 of the Data Protection Act and Regulation 20 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations.