Commercial banks and microfinance institutions across Kenya are facing heightened regulatory scrutiny as the Office of the Data Protection Commissioner (ODPC) aggressively enforces compliance under the Data Protection Act, 2019. A series of recent enforcement notices, financial penalties, and formal investigations signal a firm regulatory posture against corporate entities that compromise customer confidentiality, ignore opt-out requests, or share financial data without explicit consent.

In one of the most notable multi-entity enforcement actions, Kenya Women Microfinance Bank (KWFT), Co-operative Bank of Kenya, and Family Bank were hit with a combined penalty of Ksh. 650,000.

The breach occurred when KWFT attempted to sell a borrower’s loan portfolio to Co-operative Bank and Family Bank. During negotiations, KWFT transmitted sensitive personal information, contact records, and granular financial details without obtaining the customer’s prior informed consent.

Co-operative Bank faced additional administrative action, receiving an extra Ksh. 50,000 fine for sending persistent, unsolicited marketing messages concerning a dormant account/till to a customer who had not authorized direct marketing outreach.

1. Unsolicited marketing and ignored opt-out requests

The regulator has made it clear that direct marketing without an explicit opt-in, or failing to process opt-out notices, constitutes a serious statutory breach:

A. SBM Bank Kenya

Hit with a Ksh. 450,000 fine after dispatching 327 unsolicited transaction and promotional emails over a 10-month period to a non-customer, Kevin K. Rono. Despite formal complaints filed through SBM’s customer support desk, the bank failed to rectify the mailing lists or halt communications.

B. Family Bank Limited

Ordered to pay Ksh. 250,000 to Jackson Irungu, a non-customer who was subjected to continuous unsolicited email campaigns. The ODPC cited Family Bank for systematically ignoring service complaints and failing to provide an effective mechanism to unsubscribe.

2. Misdirected statements and confidentiality lapses

Data accuracy and recipient verification remain critical vulnerabilities for financial institution operations.

A. NCBA Bank PLC

Fined Ksh. 250,000 following a sustained breach involving the transmission of a client’s confidential business records and transaction data to an incorrect email address. The bank continued the dispatch over an extended period despite clear notification and requests for correction from the affected customer.

B. Diamond Trust Bank (DTB Kenya & DTB Uganda)

Penalized a combined Ksh. 500,000 (Ksh. 250,000 per territorial entity) after a customer continuously received private financial statements meant for another individual, reflecting systemic flaws in user identity validation and database management.

3. Active investigations into unauthorized disclosures

Regulatory focus has also expanded into joint-account governance and third-party disclosures.

Prime Bank Limited

Currently subject to formal ODPC regulatory proceedings under Complaint No. 1615 of 2023. The investigation focuses on allegations that the lender improperly disclosed confidential joint bank account records and transaction histories to unauthorized third parties without seeking the primary account holders’ consent.

These enforcement actions demonstrate that the ODPC is actively penalizing both technical security failures and administrative negligence. Financial institutions operating in Kenya are under growing operational pressure to audit their marketing automated systems, strengthen email dispatch validation protocols, and strictly enforce explicit consent mechanisms when handling customer information.