Skip to content

The ODPC is Watching: Capital Sacco Faces Enforcement Without a Single Customer Complaint

The Regulator is No Longer Waiting for Complaints In a recent determination against Capital Sacco Limited, the Office of the Data Protection Commissioner (ODPC) proved it will not wait for the public to report privacy…

Herman TamboFounder & Lead Advocate

3 min read

In this article
  1. The Regulator is No Longer Waiting for Complaints
  2. What Triggered the Investigation?
  3. The Violations
  4. The SACCO’s Defense
  5. Key Lessons for Businesses
  6. The Outcome
  7. Are your marketing practices putting you at risk?

The Regulator is No Longer Waiting for Complaints

In a recent determination against Capital Sacco Limited, the Office of the Data Protection Commissioner (ODPC) proved it will not wait for the public to report privacy violations. On March 24, 2025, the ODPC opened an investigation into the SACCO entirely on its own initiative. The regulator noticed public interest around how the institution handled personal data and decided to step in.

The ODPC proactively monitors the market and will launch investigations into highly visible privacy risks on its own motion.

What Triggered the Investigation?

The ODPC launched a broad review of the SACCO’s data processing practices. The regulator focused heavily on how the institution used customer images for promotional and marketing purposes. The investigation noted that these images were used without proper notice, without consent, and without informing individuals of their rights.

The ODPC also investigated the retention of personal data for undefined periods and a lack of adequate data safeguards. To verify these concerns, the ODPC conducted a physical site visit at the respondent’s premises in October 2025.

Regulators are conducting physical site visits to audit the reality of daily data processing habits.

The Violations

The ODPC found multiple serious compliance failures. The alleged violations included taking photos of customers without consent, posting photographs of children on Instagram, failing to process data transparently, and using personal data to advance commercial interests. The SACCO also failed to provide a way for individuals to exercise their data rights.

The investigation looked past technical errors and assessed the entire compliance culture of the business.

Using customer photos for marketing without explicit, documented consent is a severe compliance violation.

The SACCO’s Defense

Capital Sacco argued it was a registered data controller. The institution claimed it relied on legal obligations, vital interests, and consent to process the data. It pointed to its internal complaints forms, application forms, opt out forms, and requests for information statements as proof of compliance.

The ODPC rejected this defense. While the respondent was registered, it failed to prove its compliance story. The SACCO published images of adults and minors on its website and Facebook page for commercial purposes but could not produce any actual proof of consent.

Having blank consent forms on file means nothing if you cannot prove a specific individual actually signed one.

Key Lessons for Businesses

This decision outlines several strict rules for any organization processing personal data in Kenya.

  • Registration is not compliance: Being registered as a data controller is just the starting point. The ODPC explicitly noted the respondent was registered but still found it entirely non compliant.
  • Public marketing is high risk: Using customer images on websites and social media platforms for commercial gain requires a strict legal basis, proven consent, and transparency.
  • Children’s data requires strict verification: Processing images of minors demands age verification mechanisms and clear consent from a parent or guardian. The SACCO failed to demonstrate either.
  • The duty to notify must be specific: Organizations must actively inform individuals about their rights, the nature of the data collected, the purpose of processing, and third party disclosures. Vague internal practices do not satisfy this legal requirement.

Cosmetic compliance will not survive a regulatory audit of your online and offline marketing channels.

The Outcome

The Data Commissioner formally found the respondent non compliant and ordered the issuance of an enforcement notice. The respondent received a 30 day window to appeal the decision to the High Court.

Publishing non compliant marketing material can result in formal regulatory enforcement actions that become public record.

Are your marketing practices putting you at risk?

Does your business use customer images online without a bulletproof consent trail? Do not wait for an ODPC site visit to find out you are non compliant. Take our Quick Data Protection Diagnostic Tool to identify your marketing compliance gaps in minutes.

Read the Full Decision:

You can review the official ODPC determination here: https://www.odpc.go.ke/wp-content/uploads/2026/02/CAPITAL-.pdf

Tools for this topic · Data Protection

Data protection compliance checklistThe registration, policies and records the ODPC expects to see. Fee estimator: data protectionAn indicative fee memo for ODPC registration and compliance work.

General information, not legal adviceThis article explains the law in general terms and does not create an advocate–client relationship. For advice on your situation, .

Share

Founder & Lead Advocate

Herman advises founders, businesses and families on company, commercial, property, succession and data protection matters in Kenya, and writes these guides to make the law easier to act on.

About HermanMeet the teamLinkedIn

Managing this from abroad?

Turn the guidance into a remote Kenyan legal route.

Use the Diaspora Desk to organise documents, verification and the right next step for a Kenyan property or estate matter.

Open the Diaspora Desk
WhatsApp Us