Who Told Them?

The Law You Live, Season 2, Part 1

Who Told Them?

By Tim Munyi Mugo*

“Congratulations! You qualify for Kshs. 60,537 PCASH Business Loan today. To get, Dial *321*5# Apply Instantly & repay in 90days or visit PCASH app”. This arrives on a random Tuesday morning, promising a loan you never applied for, from a digital lender you have zero idea about, on a number you can swear with someone’s grave you never shared for that purpose.

The natural reaction is a shrug and a delete. The correct reaction is a single question.

Who told them?

That question is in substance, the entire Data Protection Act, Cap 411C. It is also a question my own industry must answer about its own customers, and I will come to that.

Personal data is anything from which you can be identified. Your name, your mobile number, your ID, your photograph, your location, your M-Pesa history, or even your meter reading. You are the data subject. Whoever decides what is done with that information is the data controller, and the Act follows them closely.

THE DEFINITION  |  Section 2 of Cap 411C defines “data controller” as a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data

The working word in that definition is determines, not about who holds data or who does the keying.

In that regard, the Act does not only govern Safaricom, the banks, the hospitals or the digital lenders.

It governs your landlord, who keeps your ID copy and payslips in an old used envelope in one of those suitcases or safes. It governs your Sacco, and the funeral or wedding committee Whatsapp group that publishes contributors’ names alongside their mobile numbers. And it governs the security desk at the office entrance, where a sometimes clueless guard writes down your car registration, ID, name and telephone number, then leaves the book open for the reading pleasure of whoever signs next.

ON THE RECORD  |  The ODPC publishes determinations on its website, year by year, with parties named. Open the 2026 list and you will find complaints determined against a Sacco, a hospital in Eldoret, an insurance broker, several digital lenders, a recruitment agency / firm, a dry cleaner, a girls’ school, a media house, and a water & sewerage company

I would not have guessed the dry cleaner either.

The Act rests on principles that read like ordinary good manners, until you see how routinely they are broken.

THE PRINCIPLES  |  Section 25, Data Protection Act, Cap 411C. Personal data must be processed lawfully, fairly, and transparently. It must be collected for explicit, specified, and legitimate purposes. It must be adequate, relevant and limited to what is necessary. It must be accurate and kept no longer than necessary. And, in a provision that every Kenyan should memorise ‘collected only where a valid explanation is provided whenever information relating to family or private affairs is required’

Notice these three words: necessary, purpose, and explanation.

That is why I question the shops that ask us to pay by “send money to a private number”, which quietly hands a stranger your name and line. And the forms asking your marital status, next of kin or the names of your children owe you a valid explanation before you fill a single box. What is interesting is that none of these people consider themselves as offenders but most of them are.

And here is the provision that answers our Tuesday morning question directly.

THE DUTY TO NOTIFY  |  Section 29. Before collecting your data, a controller must tell you who is collecting it, why, whether the collection is mandatory or voluntary, who else will receive it, and what your rights are.

So when did the breach occur? Long before that Tuesday, and here is the uncomfortable part. I cannot tell you where, and neither can you. It may have been a counter form, a promotion I once entered, a service I registered for years ago and forgot. Section 29 gave me a right to be told, at each of those points, who was collecting and who else would receive it. What no provision gives me is a way to trace, afterwards, which controller let it go.

The Act sets out plainly what follows.

WHAT FOLLOWS  |  The consequences are in the Act itself. Section 62 empowers the Data Commissioner to issue a penalty notice. Section 63 caps the penalty at five million shillings, or, in the case of an undertaking, one per centum of its annual turnover of the preceding financial year, whichever is lower. Section 64 gives the aggrieved a right of appeal to the High Court. And Section 65 entitles a person who suffers damage to compensation, where damage is defined to include distress. In fact, distress alone is enough.

Which brings me, as ever, to water, because I sit on both sides of this counter.

Just consider what your utility holds about you. Your name. The physical address and, because our systems now map every connection, the exact coordinates of the house where the meter is installed. Your telephone number, where the bills and the arrears reminders land. Your payment history. And the most intrusive of them all, a monthly consumption figure that quietly discloses when your house was empty, when it filled up again, and roughly how many people sleep there. Water consumption data is occupancy data wearing overalls.

Section 2 defines sensitive personal data to include property details and family details. A water or electricity utility’s customer account opening form built around a property and often listing a spouse or next of kin, may therefore not be ordinary personal data at all. It may sit in Part V of the Act, where the grounds for processing are narrower and the duty heavier.

Then ask the sector questions that follow: -

·         When a utility publishes a list of defaulting customers, what is the lawful basis under section 30?

·         When a customer helpfully sends a photograph of his or her meter to a utility, and the officer who receives it forwards it to a colleague for billing and posting into the ERP, on whose devices does that image finally rest, and who deletes it?

These are not idle questions. The ODPC’s published register for 2026 records a determined complaint against a city water & sewerage company. The sector is already inside this law, whether it has noticed or not.

I raise questions, not accusations. Public bodies hold the public’s data by necessity. Carelessness is the offence, not custody.

None of this is peculiar to Kenya. Cap 411C borrows its architecture from the European General Data Protection Regulation, which is why a Kenyan controller and a British one recognise the same furniture: lawful bases, impact assessments, a seventy two hour breach clock. The difference is not in the drafting. Section 18 registers controllers only above thresholds the Commissioner sets. Section 24 says a public body may designate a data protection officer, not must. Section 56 requires a complaint to be concluded within ninety days. Meanwhile the number that reached PCASH is still out there, and no provision in this Act tells me which of the twenty counters I gave it to let it go. Reasonable principles, and a practice still catching up with them. That gap is the real subject of this series.

So begin with the discipline the Act itself begins with. The next time anyone asks for your number, your ID, or your photograph, ask the two questions this statute was written to make ordinary. Why do you need it, and what will you do with it?

Later in the season, the harder question a reader put to me after reading this piece: what this law has to say about predatory lending, personal debt, and the people least able to argue back. But next in this series, the most abused word in Kenyan compliance: consent.

Stay with me. The law you live is more interesting than the law you fear. 

 

*The author is an Advocate of the High Court of Kenya and Co-Founder of the Veritas Governance Institute.

 

 

 

Connect on LinkedIn: linkedin.com/in/tim-munyi-mugo-8194b024 

 

Catch you in the next blog!

 

Disclaimer- The information provided is for general informational purposes only and should not be considered as professional advice. Please consult a qualified professional for specific guidance.