Most Kenyans know the experience: you visit a shop, an event or an entertainment venue, hand over your phone number, and the promotional messages never stop. The Data Protection Act, 2019 gives you real tools to stop them, but using them in the right order matters.
Your rights. Section 26 of the Act sets out a data subject's rights. These include the right to be informed of how data is used, the right to object to processing, and the right to have false or misleading data corrected or deleted. Section 37 restricts the use of personal data for commercial purposes, including direct marketing, without the person's consent or a lawful basis. Section 40 provides for the rectification and erasure of personal data.
Start with the business itself. The Office of the Data Protection Commissioner expects a data subject to first exercise their rights directly with the data controller, the business sending the messages. In practice, that means a written request, kept on record, to:
- stop all marketing messages and withdraw any consent previously given;
- erase your personal data where there is no lawful basis to keep it; and
- disclose where your number was obtained and who it has been shared with.
Then the regulator. If the business ignores the request or keeps sending messages, a complaint to the Data Protection Commissioner is far stronger. You can show that you asked, that the business failed to comply, and the dates of messages sent after your request. A complaint lodged before this step may be declined or referred back.
Remedies. The Commissioner can investigate, issue enforcement notices and penalty notices, and order compensation to a person who has suffered damage from a breach of the Act.
How we assist. We prepare formal requests that leave the business no room for doubt, track the response period, and assemble the evidence for a complaint. We then pursue the matter before the Commissioner if needed.
Takeaways. Save screenshots of every unwanted message, with dates. Make your objection and erasure request in writing before complaining. Businesses should check that their marketing lists rest on genuine consent and offer an easy opt-out, since compliance is far cheaper than a penalty.