On 14 April 2026, Kenya's Office of the Data Protection Commissioner held LOLC Kenya Microfinance Bank Limited liable for publishing a former employee's images and personal details in public notices without consent or a lawful basis. Peter Macharia Waithira resigned from the lender in July 2025; the bank then circulated notices warning customers against transacting with him. He complained to the ODPC in January 2026 (Complaint No. 0213 of 2026). The remedies went beyond the usual deletion order. Data Commissioner Immaculate Kassait gave the bank 14 days to delete the data from all platforms, and recommended the company's directors for criminal prosecution after they failed to respond to the investigation. On conviction, obstruction carries a fine of up to KSh 5 million or two years' imprisonment (determination PDF, ODPC; Business Daily).
Two months earlier, the High Court showed what happens after a determination is issued. In Muthoni v Africa International University [2026] KEHC 2254 (KLR), decided 16 February 2026, a data subject who had won an ODPC compensation award (Complaint No. 0590 of 2025, determined 17 July 2025) applied to have the determination adopted as an order of the court, for KSh 250,000 (Kenya Law). The Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 permit exactly this: under regulation 14(5), the Commissioner's determinations are enforced as orders of the court, and court orders come with execution machinery. Garnishee proceedings, attachment of assets, the full toolkit.
Why it matters. For five years the standing objection to Kenya's enforcement record was that ODPC paper was just paper. A respondent could ignore a compensation award and dare the complainant to do something about it. These two decisions, read together, remove that comfort in both directions. Downstream, Muthoni shows data subjects converting awards into enforceable judgments. Upstream, LOLC shows that stonewalling the investigation itself now creates personal criminal exposure for directors. The company's cheapest option is the one many respondents used to skip: cooperate early and settle the compliance failure.
In Muthoni the High Court showed no appetite to reopen the ODPC's assessment of quantum on the merits. Respondents hoping to relitigate quantum in court face a deferential standard of review, while complainants face a mechanical registration process. That asymmetry is the story.
Who is affected. Every registered data controller and processor in Kenya, and specifically their boards. The obstruction recommendation in LOLC attaches to named directors, not the corporate vehicle. HR departments should take particular note: LOLC's violation was publishing a former employee's data, a fact pattern that recurs across the ODPC docket in employment disputes.
What to do now:
- Treat an ODPC investigation notice as a board-level event. The duty to cooperate is now backed by personal criminal exposure, and "the directors did not respond" is a documented aggravating fact.
- Budget for compensation awards as collectable debts, not negotiating positions. After Muthoni, an unpaid award is one registration application away from execution.
- Audit how your organisation handles ex-employee data, especially anything public-facing. Deletion timelines in recent determinations are short: 14 days in LOLC.