Blog by
Tracy Okal,
Data Protection Associate
South-End Tech Limited
Date: 30th September, 2025
Introduction
As technology advances, businesses have had to come up with more creative ways to promote their products beyond the traditional TV, radio, or billboards. One popular approach is using promotional messages which involves sending direct communications to inform customers about offers, discounts, or new products to drive immediate action like purchases or sign-ups.
However, many people have grown frustrated with the constant flood of unsolicited messages and are concerned about their data privacy.
In recent years, data protection has become a major focus for Kenya, leading to the enactment of the Data Protection Act. This is a great step forward in protecting consumer’s data; however, it also imposes particular obligations on you as a business owner in the course of marketing your products and services to customers.
What the Law Says
As a business owner, it’s important to understand and uphold your customers’ right to privacy as guaranteed by the Constitution. Under Kenya’s Data Protection Act, you must follow clear rules on how to collect, store, and use customer data, including contact details used for SMS marketing. This means you must:
- Obtain your customers’ consent before sending any promotional SMS
- Provide a simple and accessible way for them to opt out of receiving such messages if they choose, and
Customers also have the right to object to the use of their personal data, and if they no longer wish to receive your messages, you are required to stop sending them and sometimes delete their information completely.
The Office of Data Protection Commissioner in the case of Yasin Abukar V Wananchi Group (Kenya) T/A Zuku Fibre Kenya ordered the Respondent to compensate a customer KES 500,000 after they continued to send the customer promotional messages despite several requests to cease and erase his personal information from the company’s systems and databases.
How can your business comply with the Act in this regard?
- Ensure you collect the information directly from the customer and not a third party.
- Ensure you notify the customer that their information is collected for purposes of direct marketing: It is not enough that you include the notification in a privacy policy; the policy must also be easily accessible to customers at the point when their data is collected.
- Always obtain explicit consent from your customer before using their information for direct marketing purposes: Remember, simply making a purchase does not automatically mean they have agreed to receive promotional messages, especially if they weren’t given a chance to opt in or out.
- Provide very clear and simplified opt-out mechanisms to allow recipients to unsubscribe easily from the promotional messages: These options should include monitored communication channels like phone lines and email, and opting out should be free or involve minimal costs to the customer.
- Take strong measures to protect your customers’ data from unauthorized access, such as using encryption and other security tools.
Obligations that arise out of the Data Protection Act
In addition to the requirements above, you should also be mindful of other important obligations that arise outside the Data Protection Act.
These include;
- Observing timing restrictions by limiting promotional messages to business hours, typically between 8 a.m. and 8 p.m., to avoid disturbing customers.;
- Ensure that the content of your messages is always accurate and relevant to your audience;
- Every promotional message you send must clearly identify your business as the sender to build trust and avoid confusion.
Conclusion
As a business owner, it’s clear that finding the right balance between marketing and respecting your customers’ privacy is more important than ever. Promotional messages can be a powerful way to connect with your audience, but you need to use them thoughtfully and in full compliance with the Data Protection Act and its Regulations. When you get this balance right, you can effectively promote your products while demonstrating respect for your customers’ privacy.
Why Partner with South-End Tech Limited?
At South-End Tech Ltd, we recognize how important it is for your business to promote products effectively while respecting your customers’ privacy. That’s why we offer specialized Data Protection Services designed to keep your marketing compliant and build customer trust.
Contact us today for Data Protection and Cybersecurity Solutions
Phone: +254115867309, +254721864169, +254710674839, or
Email: dataprotection@southendtech.co.ke and info@southendtech.co.ke.
