Can your bank share your account information?
Banking Act; Data Protection Act · sources read 3 Oct 2026
Only as the law allows. The Banking Act bars anyone from disclosing information they get through their duties under the Act except as the Act permits, and the Data Protection Act lets your data be used only with your consent or another lawful reason. One exception: banks, microfinance banks, SACCOs and others must exchange information on non-performing loans, including through credit reference bureaus.
- How long
- The Data Commissioner must investigate and conclude a complaint within 90 days.
- Where
- First your bank; then in writing to the Central Bank of Kenya; for misuse of personal data, the Office of the Data Protection Commissioner (complaint@odpc.go.ke)
Steps
- Make a formal complaint to your bank through any of its channels, with full details.
- If the bank's answer does not satisfy you, write to the Central Bank of Kenya with the details, the bank's reply and copies of your letters with the bank.
- If your personal data was misused, you can complain to the Data Commissioner, orally or in writing.
Watch out
- Information on non-performing loans is shared between banks, microfinance banks, SACCOs, utility companies and others, as CBK guidelines set.
- The Central Bank can share information with tax and fraud agencies and the Financial Reporting Centre where needed for anti-money laundering work.
- Your data can also be used without consent where needed for a contract with you, a legal obligation, or another lawful ground in the Data Protection Act.
Who this covers
- Every bank customer: banks, like all data controllers, must handle your personal data in line with your right to privacy.
Official sources (3)
- Banking Act (Cap. 488) centralbank.go.ke · read 3 Oct 2026
- Data Protection Act (No. 24 of 2019) odpc.go.ke · read 3 Oct 2026
- Resolution of Customer Complaints in the Banking Sector centralbank.go.ke · read 3 Oct 2026