Yes — you can sue a company for a data breach in Kenya, and you don't need to choose between complaining and suing; the Data Protection Act, 2019 gives you both routes. You can lodge a free complaint with the Office of the Data Protection Commissioner (ODPC) to force the company to fix the problem, or file a civil claim in court under Section 65 of the Act to recover compensation for the harm the breach caused you. The catch most people miss: a breach notification from a company is not an admission of liability, and getting the ODPC to punish the company doesn't automatically put money in your pocket — that part still runs through court.
- You can sue a company for a data breach in Kenya under Section 65 of the Data Protection Act, 2019.
- The Office of the Data Protection Commissioner (ODPC) handles free complaints but court handles personal compensation.
- Companies face administrative fines up to KES 5 million or 1% of annual turnover, whichever is lower.
- A data controller must notify the ODPC within 72 hours of discovering a breach with real risk of harm.
- Most breach victims never see the inside of a courtroom — the ODPC complaint alone often forces a fix in 2026.
Why this matters
Kenya's Data Protection Act, 2019 is the law that makes your personal data — your ID number, phone records, M-Pesa statements, medical history, employment records — something a company has a legal duty to protect. When a bank, telco, hospital, sacco, or e-commerce platform leaks that data, you're not left with nothing but a warning email. You have a statutory right to make them account for it, both administratively through the ODPC and personally through court.
Most Kenyans who get a breach notice SMS or email don't know they have two separate options, or that one is free and one requires a lawyer. Getting this wrong wastes months.
Can I sue a company for a data breach in Kenya?
The short version: yes, through two distinct paths that serve different purposes. Here's how they compare.
| Path | Cost | Who decides | What you can get | Best for |
|---|---|---|---|---|
| ODPC complaint | Free | Data Protection Commissioner | Enforcement notice, admin fine on the company, corrective order | Stopping ongoing misuse, forcing a fix |
| Civil suit in court | Court fees + advocate fees | A judge | Personal compensation for damage suffered | Recovering money for actual harm you experienced |
You can run both at once. Filing an ODPC complaint doesn't block you from also suing for compensation, and evidence gathered in the ODPC investigation often strengthens a court claim.
Filing a complaint with the ODPC
- Write down what happened — what data leaked, when you found out, how you found out (breach notice, news report, fraud attempt).
- Lodge the complaint with the ODPC in writing, naming the data controller or processor responsible.
- The ODPC investigates and can compel the company to produce records.
- The ODPC issues a decision — this can include an enforcement notice, a compliance order, or an administrative fine against the company.
- Use the ODPC's findings as evidence if you decide to sue for compensation afterward.
This path costs nothing and doesn't require a lawyer, but it doesn't put compensation in your account — it punishes the company and can force it to change its practices.
Suing for compensation in court
- Establish the contravention — the company breached a duty under the Data Protection Act (e.g., failed to secure your data, failed to notify you of a breach affecting you).
- Show the damage you suffered — financial loss, distress, identity theft costs, fraudulent transactions traced to the leaked data.
- File a civil suit citing Section 65 of the Act, which allows a data subject to claim compensation from the controller or processor for damage suffered as a result of a contravention.
- The company can raise a defence — for instance, that it took reasonable technical and organisational measures despite the breach.
- The court decides whether compensation is due and how much, based on the harm you can prove.
This is the route to actual money, but it needs an advocate, proper pleadings, and evidence tying the breach to real damage — not just the fact that a breach happened.
“A breach notification tells you a breach happened. It doesn't tell you what you're owed for it.”
Why compensation amounts vary
There's no fixed payout table under Kenyan law — courts assess each claim on the facts. What tends to drive the outcome:
- Type of data leaked — financial and health data claims tend to carry more weight than a leaked email address alone.
- Provable financial loss — fraudulent M-Pesa withdrawals or unauthorized loan applications traced to the leak strengthen a claim significantly.
- How the company responded — a company that notified you within 72 hours and offered remediation looks better in court than one that stayed silent for months.
- Whether the breach was negligent or deliberate — poor security practices weigh differently than an insider deliberately selling your data.
- Number of people affected — a mass breach can trigger regulatory scrutiny that a single-person incident doesn't.
- Evidence quality — screenshots, breach notices, bank statements, and the ODPC's own findings all matter when you're trying to prove damage, not just annoyance.
How do I report a data breach in Kenya?
You report it directly to the Office of the Data Protection Commissioner in writing, naming the company and describing what data was exposed and how you discovered it. The ODPC can then investigate and compel the company to respond, regardless of whether you also plan to sue for compensation.
What is the fine for a data breach in Kenya?
Under the Data Protection Act, 2019, the ODPC can impose an administrative fine of up to KES 5 million, or 1% of the company's annual turnover of the preceding financial year, whichever is lower. That fine goes to enforcement — it's separate from any personal compensation you'd claim in court.
Do I need a lawyer to sue for a data breach in Kenya?
You don't need one to file an ODPC complaint, but you generally need an advocate to file and argue a civil suit for compensation under Section 65. Court procedure, evidence rules, and drafting pleadings correctly are not things most people handle well without legal training.
If you're not sure which path fits your situation, a short call with someone who reads Kenyan law for a living beats guessing. Lex Africa connects you with LSK-verified advocates for paid 15-minute video consultations, so you can lay out what leaked, what happened after, and get a straight answer on whether an ODPC complaint, a court claim, or both make sense before you spend money on the wrong one.
Talk to a verified advocate now
15-minute video consultation on your data breach options.
FAQ
Can I sue a company for a data breach in Kenya?
Yes, under Section 65 of the Data Protection Act, 2019, you can sue a data controller or processor for compensation for damage caused by a breach. You can also file a free complaint with the ODPC separately.
How much compensation can I get for a data breach in Kenya?
There's no fixed amount — courts assess compensation based on the actual damage you prove, such as fraudulent transactions or financial loss traced to the leak. Distress alone is harder to quantify than provable financial harm.
What is the ODPC and what does it do?
The Office of the Data Protection Commissioner is Kenya's regulator under the Data Protection Act, 2019. It investigates complaints, can order companies to fix violations, and can impose administrative fines up to KES 5 million or 1% of turnover.
How long does a company have to notify me of a data breach?
A data controller must notify the ODPC within 72 hours of becoming aware of a breach that carries real risk of harm, and must notify affected individuals within a reasonably practicable time after that.
Is a data breach complaint to the ODPC free?
Yes, lodging a complaint with the ODPC costs nothing and doesn't require a lawyer. Suing for compensation in court is a separate process that typically does require an advocate.
What counts as a data breach under Kenyan law?
A data breach is any unauthorized access, disclosure, loss, or alteration of your personal data held by a company, from a hacked database to an employee leaking customer records. The Data Protection Act, 2019 applies to any data controller or processor operating in Kenya.
Can I sue if the company already paid an ODPC fine?
Yes. An administrative fine paid to the ODPC is separate from personal compensation. You can still file a civil suit under Section 65 to claim damages for what you personally suffered.
One last thing
The part that trips people up in 2026 is timing: an ODPC complaint and a court claim run on different clocks and serve different goals, so filing one doesn't pause the other, and waiting for the ODPC to finish before you even talk to an advocate about compensation often costs you months you didn't need to lose. If a company has leaked your data, get the ODPC complaint filed the same week you find out, and get a read on your compensation case in parallel — not after.
