Blog By:
Ms. Jane Ombiro, CIPP/E, CIPM, FIP
Data Protection Expert
South-End Tech Limited
Date: 21st May, 2025

Individuals and entities in Kenya who disagree with a decision made by the Office of the Data Protection Commissioner (ODPC) have a clear path to challenge that decision. Such decisions must be challenged through a statutory appeal to the High Court, as expressly provided under Section 64 of the Data Protection Act (DPA), 2019. Despite this clear provision, some entities have mistakenly pursued judicial review to challenge ODPC’s determinations instead of an appeal, leading to their cases being dismissed by the High Court.

The High Court of Kenya has consistently interpreted Section 64 of the DPA in three significant cases

1. Ceres Tech Ltd Vs ODPC (2024): In this case, the ODPC found Ceres Tech Ltd liable for multiple violations of the Data Protection Act, including sending unsolicited messages and calls to data subjects to induce them to take loans. The ODPC ordered the company to pay KES 2,600,000 in compensation to three data subjects. Ceres Tech Ltd sought to challenge this decision through a judicial review application to the High Court. However, the High Court dismissed the application on the grounds that it lacked jurisdiction because an appeal under Section 64 had not been lodged.
2. Swara Acacia Lodge Vs the ODPC & another (2025): The applicant, Swara Acacia Lodge, had been directed by the ODPC to compensate Terence Adriano KES 250,000 for continuing to use his image for commercial purposes after he had withdrawn consent. Instead of filing an appeal under Section 64 of the DPA, Swara Lodge initiated judicial review proceedings. This resulted in their application being dismissed by the High Court.
3. Republic Vs ODPC & Hotel Water Buck Ltd & Victor Kibet Siele (2025): The ODPC had ruled that Hotel Water Buck Ltd used Victor Kibet Siele’s image on its website for commercial purposes without consent and ordered compensation of KES 500,000. The hotel sought to overturn this decision via judicial review, but the High Court relying on the Swara and Ceres Tech precedents dismissed the application. The judge in the Hotel Water Buck’s case reiterated that any grievance against the Data Protection Commissioner’s decision must be appealed in line with Section 64 of the DPA. The court emphasized, quoting established judicial precedent, that mechanism must be followed, and judicial review relief is not available to the aggrieved party.”

In conclusion, individuals and entities who wish to challenge a decision made by the Data Protection Commissioner must pursue a statutory appeal to the High Court under Section 64 of the Data Protection Act, 2019, rather than resorting to judicial review. Failure to do so will likely result in their applications being dismissed on jurisdictional grounds.

For tailored support on data protection compliance or cybersecurity solutions, reach out to us:
📞 +254 115 867 309 | +254 721 864 169 | +254 740 196 519
📧 jombiro@southendtech.co.ke | dataprotection@southendtech.co.ke | info@southendtech.co.ke