Kenya’s Office of the Data Protection Commissioner (ODPC) has found Capital Sacco Limited non-compliant following a suo moto investigation into how the Meru-based credit facility collected, processed, stored and used customers’ personal data, especially images of adults and minors for promotional and marketing purposes.
The investigation, opened on 24 March 2025 under Suo Moto Investigation No. ODPC/SM/0010/2025, examined whether Capital Sacco complied with Kenya’s Data Protection Act, 2019 in handling customer photographs and other personal information published online.
According to the determination issued on 9 January 2026, the Office of the Data Protection Commissioner found that Capital Sacco published images of adults and minors on its website and Facebook page for commercial purposes without providing proof of consent or age-verification mechanisms required under the law. Data Commissioner Immaculate Kassait ordered an enforcement notice against the Sacco and stated that the institution has the right to appeal the determination before the High Court within 30 days.
The Office of the Data Protection Commissioner launched the investigation after public interest emerged around the Sacco’s personal data practices. The regulator issued a notification requiring the lender to explain its lawful basis for taking and using customer photos, its consent procedures, safeguards for children’s data, and measures for protecting data subject rights.
The regulator said the investigation focused on Capital Sacco’s processing activities, particularly the use of customers’ images for promotional and marketing purposes without notifying data subjects, obtaining consent, or informing them of their rights under the Data Protection Act. The Office also examined whether the Sacco retained personal data for undefined periods without adequate safeguards.
Capital Sacco told the ODPC that it was duly registered as a data controller and relied on legal obligation, vital interests, and consent as the lawful basis for processing personal data. The Sacco also stated that it had introduced consent forms, complaints forms, application forms, opt-out forms, opt-out messages, and requests for information statements to support compliance with the law. The Sacco further argued that it informed customers about the purpose of data collection, how information would be used and stored, and whether it would be shared with third parties.
However, after a site visit conducted in October 2025 and a review of the available evidence, the regulator concluded that the lender failed to demonstrate compliance with several provisions of the Data Protection Act. The ODPC found that Capital Sacco owned and operated the website and Facebook page where customer images were published for commercial purposes. Investigators said no proof of consent was provided for the use of those images.
The determination also stated that the Sacco failed to demonstrate that it had incorporated age-verification mechanisms before collecting, processing, and publishing minors’ images for commercial purposes. Under Section 33 of the Data Protection Act, personal data relating to a child cannot be processed unless consent is provided by the child’s parent or guardian and the processing protects the best interests of the child.
The Office further found that the Sacco did not adequately demonstrate how it fulfilled its duty to notify customers about their rights, the nature of data collected, the purpose of processing, third-party disclosures, and the consequences of withholding information.
The regulator concluded that the lender’s processing of personal data, particularly customer images used for commercial purposes, did not meet statutory requirements under Kenya’s data protection framework. As part of the final determination, the Office of the Data Protection Commissioner ordered the issuance of an enforcement notice against the Sacco, citing the nature and extent of violations relating to unlawful processing of minors’ personal data and the institution’s conduct during the investigation.
Jefferson Wachira is a writer at Africa Digest News, specializing in banking and finance trends, and their impact on African economies.