How to stop marketing SMS, calls and emails
Data Protection Act and Data Protection Regulations · sources read 4 Oct 2026
A business may use your personal data for direct marketing only with your consent, and every marketing message must show you a free, simple way to opt out. You can object at any time, and if they ignore you, you can complain to the Data Commissioner.
- How long
- The Data Commissioner must investigate and conclude a complaint within 90 days.
- Deadline
- A business must stop using or sharing your data for third-party marketing within 7 days of your request.
- Where
- The business sending the messages; the Office of the Data Protection Commissioner (ODPC) for complaints
Steps
- Reply to the marketing SMS with the opt-out word it gives (often STOP). Each message should tell you how.
- On a marketing call, say you don't want any more calls. You have the right to opt out verbally.
- Ask the business to stop sharing your data with others for marketing. It must do so within 7 days, at no charge.
- If the messages continue, complain to the Data Commissioner, orally or in writing. The complaint must be concluded within 90 days.
Watch out
- Using personal data for commercial purposes without consent is an offence: a fine of up to KSh 20,000, up to 6 months in jail, or both.
- Automated marketing calls and marketing emails need your prior consent; sending them without it is an offence.
- If you bought from a company and gave it your email, it may email you about its own similar products, but must let you object for free each time.
Who this covers
- Anyone whose personal data, such as a phone number or email, is used to send them marketing.
Official sources (3)
- Data Protection Act, 2019 (No. 24 of 2019) new.kenyalaw.org · read 4 Oct 2026
- Data Protection (General) Regulations, 2021 (L.N. 263 of 2021) odpc.go.ke · read 2 Oct 2026
- Kenya Information and Communications (Consumer Protection) Regulations, 2010 ca.go.ke · read 2 Oct 2026