When “Stop” Means Stop: ODPC Fines Nairobi Water KES 250,000 for SMS Spam

The ODPC’s Clear Message

The Office of the Data Protection Commissioner (ODPC) recently drew a hard line on unwanted text messages. In the case of Gachiri Ndungo v Nairobi City Water & Sewerage Company, the regulator ruled that organizations cannot continue messaging individuals who have explicitly asked them to stop. The decision proves that the legal right to object carries real weight and financial consequences. The ODPC is fully prepared to enforce this right and award compensation to victims.

What Happened?

A man began receiving frequent SMS messages from Nairobi City Water despite never being a customer. He sent the company a cease and desist email demanding an immediate end to the texts. The messages kept coming anyway.

He filed a complaint with the ODPC, arguing the texts violated his privacy, caused distress, and falsely implied he owed the company money. Nairobi City Water claimed it acquired the number during routine customer service inquiries. The company admitted to receiving the objection but blamed an “internal handling lapse” for the continued messages. They eventually deleted the number from their system and admitted they lacked consent.

The Ruling

The ODPC ruled in favor of the complainant. Under Section 26 of Kenya’s Data Protection Act, individuals have a right to object to the processing of their personal data. Once someone objects, the burden shifts to the organization to prove it has a lawful reason to continue.

Nairobi City Water failed to provide this justification. The Commissioner completely rejected the “internal lapse” defense. A failure of staff or internal systems to process an opt out request remains a legal violation. The ruling makes it clear that organizations are fully accountable for ensuring their internal controls actually work in practice.

Why This Case Matters

This ruling sets a precedent for all businesses and public bodies in Kenya.

First, objection requests require immediate action. Organizations cannot sit on them or route them through slow internal channels. Second, operational inefficiencies do not offer legal protection. If a request is lost, ignored by staff, or mishandled, the company remains at fault. Finally, the ODPC recognizes emotional distress as a valid harm. The regulator will award monetary compensation for the frustration of dealing with persistent and unwanted communications, even if no financial money was lost.

The Outcome

Nairobi City Water was ordered to pay the complainant KES 250,000 in compensation. The ODPC chose not to issue a formal enforcement notice because the company had eventually deleted the number from its systems. Both parties received a 30 day window to appeal the decision to the High Court.

The Practical Lesson

Collecting a phone number does not grant a lifetime pass to use it however you see fit. When a person says enough, your organization needs the technical systems, legal basis, and staff discipline to stop processing their data immediately. Compliance relies entirely on execution. If your team cannot execute a stop request, you risk regulatory action.

Are your internal systems ready?

Does your business know how to handle an opt out request before it becomes a KES 250,000 problem? Do not wait for an ODPC complaint to find out. Take our Quick Data Protection Diagnostic Tool to identify your compliance gaps in minutes.

Read the Full Decision:

You can review the official ODPC determination here: GACHIRI NDUNGO VS NCWSC