Kenya’s Data Protection Office Fines Two Fintechs Over Privacy Breaches

Kenya’s Office of the Data Protection Commissioner (ODPC) has fined two major fintechs—Branch and OKash—Ksh5 million each for unauthorized data collection and sharing. The ruling, issued in March 2024, found the firms scraped users’ call logs, contacts, and location without clear consent. ODPC ordered immediate deletion of unlawfully obtained data and mandated privacy audits. The fines mark Kenya’s first enforcement actions under the Data Protection Act (2019). Fintechs now have 90 days to comply with new guidelines on data minimization and retention. The move strengthens Kenya’s digital trust framework ahead of increased cross-border data flows under AfCFTA.