Kenya’s Data Protection Act 2019 and its regulations have changed how lenders can market to people. The Office of the Data Protection Commissioner (ODPC) has fined lenders for unsolicited marketing, and its decisions give useful guidance on what is — and is not — acceptable.
This guide is general information, not legal advice. Consult your legal adviser about your institution’s situation.
Consent is required for direct marketing
The Act restricts the use of personal data for commercial purposes, including direct marketing, unless the person has consented. The ODPC has held that express consent is required even where contact details are publicly available.
A transaction is not consent
In one determination, the ODPC found that the fact a customer paid through M-PESA did not amount to consent to receive marketing messages. The same logic applies to lenders: a loan application or repayment is not permission to send offers.
Enforcement against lenders
- The ODPC fined Platinum Credit KES 400,000 over unsolicited loan text messages and calls to a person who had not consented.
- In another complaint, the ODPC found that UMBA Microfinance Bank had sent direct-marketing messages without first obtaining the complainant’s express consent.
Opt-outs must be simple
People have the right to object to direct marketing at any time, and controllers must offer a simplified opt-out. Honour opt-outs promptly and across all channels.
What good practice looks like
- Collect consent explicitly — for example, an unticked checkbox on your sign-up form with clear wording.
- Record when, where and how each person consented.
- Do not buy or rent contact lists.
- Include a working opt-out in every marketing message.
- Be able to show a person all the data you hold about them, and to erase it on request.
Beyond Kenya
Uganda, Tanzania, Rwanda, Nigeria, Ghana and South Africa all have data-protection laws with similar consent and opt-out principles. Building your growth process around consent works across all of them.