How to File a Personal Data Complaint with ODPC in Kenya
If an organisation, employer, lender, app, school, hospital, marketer or individual has misused your personal information in Kenya, you can lodge a complaint with the Office of the Data Protection Commissioner (ODPC). The process is especially relevant where personal information has been collected, shared, published or used in a way you believe violates your data-protection rights.
Who can file a complaint?
The ODPC says a complaint may be filed by the affected data subject or by a person acting on the data subject’s behalf. If you are filing for another person, you should be prepared to provide authorisation.
Examples of information that may support a complaint
The exact evidence depends on the situation, but useful records may include:
- Screenshots of messages, posts or account activity.
- Emails or letters sent to the organisation.
- Contracts, application forms or consent notices.
- Transaction records where the complaint involves a service.
- Copies of requests you made asking an organisation to correct, delete or explain the use of your data.
- Any response you received.
How to file an ODPC complaint online
- Go to the official ODPC website and open the File a Complaint service.
- Indicate whether you are filing for yourself or for another person.
- Enter the complainant’s identification and contact information.
- Provide details of the respondent — the person or organisation you are complaining about.
- State when the alleged infringement occurred.
- Describe what happened and any actual or potential harm.
- Explain the remedy or outcome you are seeking.
- Upload relevant supporting documents where available.
- Review the information carefully before submitting.
The ODPC online form also asks whether you have already taken other steps to resolve the issue and whether there are people who can provide further relevant information.
Complaint or data-breach report?
These are different processes. The ODPC explains that its data-breach reporting form is intended for a data controller or data processor — or someone acting for one — notifying the regulator of a personal-data breach. If you are an individual complaining that your own data has been misused, the complaint process is generally the relevant route.
What should you write in the complaint?
Keep the explanation factual and chronological. Identify the information involved, who handled it, what you believe happened, when you discovered it, what steps you have already taken, and what remedy you are requesting. Avoid adding unrelated allegations that you cannot support with documents or specific facts.
Protect your evidence
Save original copies of relevant messages, emails, screenshots and documents. Where possible, keep dates, sender details and reference numbers visible. Do not publicly post additional sensitive information simply to prove that it was exposed.
ODPC contact options
The ODPC publishes online complaint channels as well as contact information for its Nairobi head office and regional offices. Because office details can change, check the current ODPC contact page before travelling.
Official sources
This guide is based on the ODPC’s File a Complaint page and its guidance on reporting a data breach.
Important: This article provides general public-information guidance and is not legal advice. If your situation involves significant financial loss, threats, identity theft, litigation or urgent safety concerns, consider obtaining professional advice and contacting the appropriate authorities.
