Can a loan app contact your friends and family about your debt?
Central Bank of Kenya Regulations, 2022; Data Protection Act, 2019; Office of the Data Protection Commissioner · sources read 4 Oct 2026
No. A licensed digital lender and its staff or agents may not access your phonebook to message your contacts about late payment, call or text your contacts uninvited, threaten you, use obscene language, or post your details online to shame you. It also may not share your information with others without your consent unless a law requires or allows it.
- Deadline
- The lender has up to 30 days to resolve your complaint.
- Where
- The loan app's complaints channel; the Office of the Data Protection Commissioner (odpc.go.ke)
Steps
- Complain to the loan app through its complaints channel. It must resolve the complaint within 30 days.
- Complain to the Data Protection Commissioner on odpc.go.ke or by email to complaint@odpc.go.ke if your data or contacts were misused.
- The Data Commissioner must investigate and conclude a complaint within 90 days.
Watch out
- A loan app may only access and collect the information it reasonably needs to assess, approve, pay out and collect your loan.
- These rules cover digital credit providers. They do not apply to banks, microfinance banks or Saccos, which have their own regulators.
- Under the Data Protection Act, the personal data a lender handles must be limited to what is necessary for its purpose.
- Under the Data Protection Act, a lender may only use your personal data with your consent for a stated purpose, or where the law gives another lawful ground, such as needing it to perform your loan contract.
- Processing your data without consent or another lawful ground is an offence under the Data Protection Act.
Who this covers
- People who borrow from a digital credit provider (loan app).
- The rules also protect any other person, including your contacts, from these collection tactics.
Official sources (3)
- The Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 (L.N. 46 of 2022) centralbank.go.ke · read 4 Oct 2026
- FAQs odpc.go.ke · read 2 Oct 2026
- Data Protection Act (No. 24 of 2019) odpc.go.ke · read 2 Oct 2026