That Quick Email Forward Just Cost KES 262,500: The Hidden Danger of Sharing Customer Data

That Quick Email Forward Just Cost KES 262,500: The Hidden Danger of Sharing Customer Data

You receive a promising CV and forward it to a partner. You pass a warm sales lead to a trusted vendor. You send a client intake form to an external consultant.

It happens hundreds of times a day in Kenyan businesses. It feels like basic networking. But according to a recent ruling by the Office of the Data Protection Commissioner (ODPC), that quick click of the “forward” button is entirely enough to land your business in serious legal trouble.

The CV that triggered an investigation

The ODPC recently penalized a recruitment firm, Brites Management, for what many would mistakenly call standard industry practice.

A job seeker applied for a Legal Assistant position through the firm. Sometime later, she was contacted by a completely different law firm. Startled, she asked how they got her details, and they admitted the recruiter had passed her CV along.

She filed a complaint with the ODPC. The regulator investigated and slapped the recruitment firm with a KES 262,500 fine.

Why? Because collecting someone’s data for one specific reason doesn’t give you a blank check to share it with whoever you think might be interested.

Where the business went wrong

The ODPC’s ruling dismantled several common excuses businesses use when handling data, highlighting three massive operational blind spots:

• The right to know: The applicant had a fundamental right to know her data was being shopped around. By keeping her in the dark about the onward transfer, the business violated Section 26(a) of the Act.
• The “Industry Standard” myth: The recruiter argued that sharing CVs with prospective employers is just how recruitment works. The ODPC disagreed. You must have a distinct, lawful basis to share someone’s personal data with a third party. “It’s what we do” is not a legal defense.
• The buried privacy policy: Stashing a privacy policy on your website or burying a link in an email signature is no longer enough. The Data Protection Act requires you to actively notify people about exactly who will be looking at their information before or at the moment you collect it.

Opening a can of worms

The case proves that a single grievance can crack open your entire back-office operation.

The ODPC didn’t just look at the forwarded email. While investigating the complaint, the regulator noticed the company wasn’t even registered as a data controller or processor, which is a baseline legal requirement in Kenya. Along with the hefty fine, the ODPC gave them a strict 14-day deadline to get legally registered.

One annoyed jobseeker exposed bad notices, a lack of legal basis, and a glaring registration gap all at once.

Who needs to pay attention?

While this case centered on a recruiter, the precedent hits almost every sector. You are carrying the exact same risk if you are:

• A B2B consultant passing client leads to other service providers.
• A real estate agency sharing inquiries with independent brokers.
• A school passing parent contact lists to external uniform vendors.
• A tech startup sharing user onboarding data with affiliate partners.

How to fix your workflow

Data breaches aren’t always caused by cybercriminals hacking into mainframes. More often than not, they happen because someone in the office forwarded a file without asking permission first.

You don’t need to halt your operations, but you do need to align your daily habits with the law. Look closely at your website forms, your intake contracts, and your daily workflows. Are you explicitly telling people upfront where their information is going? And more importantly, does your actual day-to-day sharing match the promises you made when they first clicked “submit”?

If the answer is no, it is time to fix your paperwork before a forwarded email becomes a regulatory nightmare.