Most of us have received an email we never asked for, we delete it and move on but in 2025, one unsolicited email about an investment product turned into a formal complaint before the Office of the Data Protection Commissioner (ODPC), and the outcome has quietly shaped how data breach claims are now understood in Kenya.
The case, Andrew Endovo v. Standard Investment Bank (Complaint No. 0697 of 2025), may seem simple on its face. Standard Investment Bank (SIB) sent Mr. Endovo a promotional email about its Mansa X Special Fund. He insisted he had never consented to receive such communication and on that basis, he argued that his rights under the Data Protection Act, 2019 had been violated and sought compensation. What started as a minor complaint quickly raised a deeper legal question: when a data breach is established, is compensation automatic?
SIB’s response was calculated and grounded in the law. First, the bank explained that it had attempted to resolve the matter amicably under Regulation 15 of the Data Protection (Complaints Handling Procedures and Enforcement) Regulations, 2021, but the complainant declined. More importantly, the bank argued that there was no proof of harm. Mr. Endovo had not demonstrated any financial loss, emotional distress, or inconvenience serious enough to justify compensation. SIB also moved quickly to correct the situation by deleting his contact details from all marketing systems and undertaking not to contact him again.
This set the stage for the ODPC’s determination, which clarified an important legal principle under Section 65 of the Data Protection Act. The ODPC confirmed that compensation is not automatic. A complainant must prove that they suffered actual damage, whether financial loss or distress, before compensation can be awarded. In other words, a breach alone is not enough.
The decision went further to confirm that the Act does not impose strict liability on data controllers or processors. Organisations are not automatically required to pay damages simply because a breach occurred. The burden of proof starts with the data subject. It is the complainant who must first show how they were affected before the responsibility can shift to the organisation.
However, the ODPC did not let the bank off entirely. It found that sending the unsolicited email still amounted to a breach of Sections 26(a) and 26(c) of the Act, which requires personal data to be processed lawfully and with proper notice. Consent remains central to data protection compliance, and even a single unauthorised email can violate that principle.
Despite the limited evidence of harm, the ODPC awarded Kshs. 50,000 to the complainant. This outcome may appear contradictory at first glance. If harm was not clearly proven, why award compensation at all? One reading is that the ODPC treated the inconvenience or intrusion of the unsolicited email as a minimal form of distress. Another is that the award served as a modest acknowledgement that a legal right had been violated, while still recognising SIB’s swift corrective action. What is clear is that the amount was deliberately kept low, reflecting both the minor nature of the breach and the bank’s mitigation efforts.
This balance is what makes the decision important. It shows that Kenyan data protection law is moving toward a more measured and practical approach. Breaches are taken seriously, but compensation is not treated as automatic or punitive.
This decision carries important lessons for both organisations and individuals. For organisations, it shows that compliance is not optional. Even small actions, like sending one marketing email without consent, can lead to legal consequences. At the same time, it highlights the value of acting quickly when a breach occurs. Prompt mitigation, such as deleting data and preventing further communication, can significantly reduce exposure. For data subjects, the case is a reminder that claims must be supported by evidence. It is no longer enough to simply allege a breach and expect compensation. There must be a clear link between the breach and the harm suffered, whether that harm is financial or emotional.
More broadly, the decision strengthens the growing body of data protection jurisprudence in Kenya. It moves the conversation away from automatic penalties and towards a more balanced approach that considers both accountability and fairness. It recognises that while rights must be protected, compensation must also be justified.
In the end, the Endovo decision shows that data protection law in Kenya is maturing. It confirms that even small breaches matter, but it also insists that compensation must be justified. In a fast-growing digital environment where personal data is constantly used in marketing and communication, that balance will shape many future decisions. Sometimes, it only takes one email to test the limits of the law and to clarify how it should work.