Can I get compensation if my data was misused?
Data Protection Act, 2019 · sources read 4 Oct 2026
Yes. If a company breaks the Data Protection Act and you suffer damage, you are entitled to compensation from it, and damage includes distress, not only money lost. You can complain to the Data Commissioner for free, who can order the company to pay you compensation.
- How long
- The Data Commissioner must investigate and finish a complaint within 90 days.
- Deadline
- The Data Commissioner must send both sides the decision in writing within 7 days of making it.
- Where
- Office of the Data Protection Commissioner (online at cie.odpc.go.ke)
Steps
- Complain to the Data Commissioner. Making the complaint is free.
- After investigating, the Data Commissioner can order the company to pay you compensation.
- The decision binds both sides and is enforced like a court order.
Watch out
- A fine imposed by the Data Commissioner is paid to the Office of the Data Commissioner, not to you. Compensation is separate.
- The highest fine is KSh 5 million, or for a business 1% of its previous year's turnover, whichever is lower.
- A company that only processes data for another is liable only if it broke its own duties or went outside its client's lawful instructions, and a company is not liable if it proves it was in no way responsible.
Who this covers
- Anyone who suffers damage because a company or organisation broke the Data Protection Act.
- Damage covers financial loss and also harm that is not financial, such as distress.
Official sources (2)
- Data Protection Act, 2019 (No. 24 of 2019) new.kenyalaw.org · read 4 Oct 2026
- Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 (L.N. 264 of 2021) odpc.go.ke · read 3 Oct 2026