Nairobi, Kenya – February 19, 2025. In a landmark ruling reinforcing Kenya’s data privacy laws, Wananchi Group Limited, the parent company of Zuku, has been fined KES 500,000 for violating a former customer’s data protection rights. The Office of the Data Protection Commissioner (ODPC) has also recommended the prosecution of Zuku’s directors for obstructing an official investigation into the matter.
The Privacy Violation Case
The case stems from a complaint filed on November 18, 2024, by Yasin Abukar, who alleged that Zuku continued sending him promotional messages despite his explicit requests for them to stop.
Mr. Abukar had terminated his services with Zuku years prior and had repeatedly requested the deletion of his personal data through:
✔ Verbal requests
✔ Phone calls
✔ Emails
However, Zuku allegedly ignored his requests. Furthermore, an invalid email address listed on Zuku’s website prevented direct communication, making it impossible for him to escalate his complaint.
ODPC Investigation & Zuku’s Non-Cooperation
Following Abukar’s complaint, Zuku denied receiving any data deletion request from him. To verify this, the ODPC conducted an on-site visit to Zuku’s offices on February 11, 2025.
However, Data Commissioner Immaculate Kassait revealed that Zuku refused to comply with a court-issued search warrant, blocking ODPC officers from accessing:
🔹 Digital and manual records
🔹 Company databases
🔹 Relevant customer data systems
Ms. Kassait stated:
“The respondent (Zuku) was uncooperative and refused to comply with the court order granting the Office (ODPC) access to search the respondent’s premises, digital and manual records, system(s), and database(s).”
The ODPC determined that Zuku’s actions hindered the investigation and that their denials lacked credibility due to their refusal to provide access to relevant records.
Legal & Financial Repercussions
The ODPC ruling, issued on February 15, 2025, includes:
✅ KES 500,000 fine against Zuku for non-compliance with data privacy regulations.
✅ Recommendation for the prosecution of Zuku’s directors for obstructing an official investigation.
The case highlights the growing enforcement of Kenya’s Data Protection Act, which mandates that businesses:
✔ Respect consumers’ privacy rights
✔ Comply with data deletion requests
✔ Ensure proper handling of personal data
Broader Implications for Consumers & Businesses
This ruling sets a critical precedent for data privacy enforcement in Kenya.
🔹 For consumers, it reinforces that they have legal protection against unauthorized data usage and that companies must respect their privacy rights.
🔹 For businesses, it underscores the need to strengthen data compliance measures to avoid legal and financial penalties.
Right to Appeal
Zuku and its directors have 30 days to appeal the ruling at the High Court. However, the ODPC’s stance sends a clear message that violations of Kenya’s data protection laws will not go unpunished.
As global data privacy concerns continue to rise, this ruling marks a turning point in how Kenya enforces its data protection laws, setting a precedent for future cases.
