The Office of the Data Protection Commissioner recently fined Platinum Credit Limited KES 400,000 for sending promotional text messages without consent.
Central to the case was Samuel Kamau Waweru, who received unwanted marketing SMS from the lender. What most Kenyans dismiss as spam is now confirmed as illegal under the Data Protection Act.
The ruling is simple: your phone number is not a marketing license. Businesses cannot assume they have permission to send advertisements just because someone took a loan, downloaded an app, or shared contact details in the past.
Consent must be clear, informed, and specific. Once withdrawn or absent, continued marketing messages become illegal.
This follows a similar case last year where Pepinos Pizza Inn was fined KES 250,000 for the same violation. Pepinos argued that consent was obtained during an M-PESA payment transaction. The ODPC rejected this outright. Consent for payment processing does not equal consent for marketing.
The regulator established that consent under the Data Protection Act must be express, free, specific, informed, and unequivocal. Data collected for one purpose cannot be repurposed for another without permission. This principle, called purpose limitation, is now actively enforced in Kenya.
Another critical requirement is providing clear opt-out mechanisms. Businesses that fail to give customers an easy way to stop receiving messages violate the law, even if initial consent was obtained.
These rulings affect banks, loan apps, SACCOs, betting firms, and digital lenders. For consumers, unwanted promotional SMS can now result in compensation. For businesses, the consequences are financial penalties and regulatory action.
Many Kenyan companies have operated under the assumption that customer data from any transaction can be used for marketing. Thankfully, the ODPC has ended that practice.
Marketing is a commercial act with legal consequences, and using personal data without proper consent violates Section 37 of the Data Protection Act.
Businesses must now obtain specific consent before sending promotional messages. That consent must be separate from other transactions, clearly explained, and accompanied by a simple way to withdraw permission.
