Personal Data Misused in Kenya? How to Preserve Evidence for a Complaint
When you suspect misuse of your personal data, preserve a usable record without spreading the information further. This guide covers evidence preparation. For the submission process, see our ODPC complaint guide and the regulator’s official instructions.
Record the incident before changing anything
Save the web address or account name, the date and time, and the message or document that raised your concern. Where a screenshot is needed, include enough context to identify the sender and what happened. Keep original emails and documents where available. Do not attempt to access another person’s account to gather more evidence.
Build a short chronology
Create a dated record of when you first supplied the information, what you were told about its use, when you noticed the disputed activity and whom you contacted. Distinguish what you personally observed from what someone else told you. If you do not know how an organisation obtained your details, state that uncertainty rather than presenting a guess as a fact.
Separate originals from copies for sharing
Keep original evidence in a secure folder with access limited to people who need it. Make a separate redacted copy if you seek general advice. Hide unrelated identity numbers, home addresses, financial details and information about other people. Preserve the original for a legitimate investigator who needs it; repeatedly posting the same private document publicly may extend the harm.
Document the organisation’s response
Where safe, contact the organisation using independently verified details. Identify the information involved and ask for an explanation or a specific correction. Save your request and any response. Record a telephone conversation in written notes, including the date and the name or reference provided, without claiming your notes are a verbatim transcript.
Prepare a compact evidence index
Label supporting items in sequence: A, the original message; B, the relevant privacy notice or consent record; C, your request to the organisation; D, its reply. Explain in one sentence what each item establishes. A clear index is more useful than a large collection of unrelated screenshots. Keep an accompanying list of any important information you have not been able to verify.
Match the evidence to the correct process
The ODPC’s complaint route is for a data subject or an authorised representative. Its instructions request supporting documents and authorisation where someone acts for another person. The separate data-breach reporting route is intended for controllers or processors. Check which applies before submitting.
Address immediate account risks separately
If you suspect an account takeover or financial fraud, use the provider’s official security or support channel promptly. Change compromised credentials through the genuine service and do not share verification codes. Preparing a regulatory complaint should not delay steps needed to protect an account.
An evidence file does not establish that the law was breached; that assessment depends on the facts and the responsible authority. Keep the acknowledgement of any complaint and respond through verified channels. This is general information, not legal advice.
