Kenya: Data Protection Commissioner issued ruling in investigation into Ceres Tech Limited over violation of data protection rights (Complaint No. 1655 of 2024)

On 15 January 2025, the Office of the Data Protection Commissioner (ODPC) issued a ruling against Ceres Tech Limited (RocketPesa) with a fine of KES 700,000 following a complaint from a data subject. The ruling found that the company unlawfully processed the complainant’s personal data by associating them with a loan they had not taken, violating their rights under the Data Protection Act, 2019. Despite being notified, RocketPesa failed to respond to ODPC’s inquiries. The determination concluded that the company did not lawfully collect or notify the complainant about the use of their data, exposing them to financial fraud. As a result, ODPC ordered RocketPesa to pay the complainant KES 700,000 in compensation, issued an enforcement notice, and recommended prosecution of the company’s director for obstructing the Data Commissioner.