The ODPC is Watching: Capital Sacco Faces Enforcement Without a Single Customer Complaint
·
The Regulator is No Longer Waiting for Complaints
In a recent determination against Capital Sacco Limited, the Office of the Data Protection Commissioner (ODPC) proved it will not wait for the public to report privacy violations. On March 24, 2025, the ODPC opened an investigation into the SACCO entirely on its own initiative. The regulator noticed public interest around how the institution handled personal data and decided to step in.
The ODPC proactively monitors the market and will launch investigations into highly visible privacy risks on its own motion.
What Triggered the Investigation?
The ODPC launched a broad review of the SACCO’s data processing practices. The regulator focused heavily on how the institution used customer images for promotional and marketing purposes. The investigation noted that these images were used without proper notice, without consent, and without informing individuals of their rights.
The ODPC also investigated the retention of personal data for undefined periods and a lack of adequate data safeguards. To verify these concerns, the ODPC conducted a physical site visit at the respondent’s premises in October 2025.
Regulators are conducting physical site visits to audit the reality of daily data processing habits.
The Violations
The ODPC found multiple serious compliance failures. The alleged violations included taking photos of customers without consent, posting photographs of children on Instagram, failing to process data transparently, and using personal data to advance commercial interests. The SACCO also failed to provide a way for individuals to exercise their data rights.
The investigation looked past technical errors and assessed the entire compliance culture of the business.
Using customer photos for marketing without explicit, documented consent is a severe compliance violation.
The SACCO’s Defense
Capital Sacco argued it was a registered data controller. The institution claimed it relied on legal obligations, vital interests, and consent to process the data. It pointed to its internal complaints forms, application forms, opt out forms, and requests for information statements as proof of compliance.
The ODPC rejected this defense. While the respondent was registered, it failed to prove its compliance story. The SACCO published images of adults and minors on its website and Facebook page for commercial purposes but could not produce any actual proof of consent.
Having blank consent forms on file means nothing if you cannot prove a specific individual actually signed one.
Key Lessons for Businesses
This decision outlines several strict rules for any organization processing personal data in Kenya.
- Registration is not compliance: Being registered as a data controller is just the starting point. The ODPC explicitly noted the respondent was registered but still found it entirely non compliant.
- Public marketing is high risk: Using customer images on websites and social media platforms for commercial gain requires a strict legal basis, proven consent, and transparency.
- Children’s data requires strict verification: Processing images of minors demands age verification mechanisms and clear consent from a parent or guardian. The SACCO failed to demonstrate either.
- The duty to notify must be specific: Organizations must actively inform individuals about their rights, the nature of the data collected, the purpose of processing, and third party disclosures. Vague internal practices do not satisfy this legal requirement.
Cosmetic compliance will not survive a regulatory audit of your online and offline marketing channels.
The Outcome
The Data Commissioner formally found the respondent non compliant and ordered the issuance of an enforcement notice. The respondent received a 30 day window to appeal the decision to the High Court.
Publishing non compliant marketing material can result in formal regulatory enforcement actions that become public record.
Are your marketing practices putting you at risk?
Does your business use customer images online without a bulletproof consent trail? Do not wait for an ODPC site visit to find out you are non compliant. Take our Quick Data Protection Diagnostic Tool to identify your marketing compliance gaps in minutes.
Read the Full Decision:
You can review the official ODPC determination here: https://www.odpc.go.ke/wp-content/uploads/2026/02/CAPITAL-.pdf
Ready to discuss your legal needs?
Get the clarity and guidance you need. I am here to help you navigate your legal journey with confidence.