By Metridata Editorial Team · Updated September 2026 · 7 min read · Digital Marketing
A customer buys from you and pays by M-Pesa. Their number is now sitting in your phone, your till report or your CRM, and sending them a promotion feels like the most natural thing in the world. Kenya’s Office of the Data Protection Commissioner (ODPC) has said, repeatedly and with fines attached, that it is not.
If you send bulk SMS, run WhatsApp broadcasts or email your customers, this one matters more than any algorithm change. It is also fixable in about a week.
What has actually happened
Techweez reported in January 2026 that the ODPC fined a lender, Platinum Credit Limited, KES 400,000 for sending promotional text messages without consent. In the coverage of related cases, a business argued that the customer had given consent while paying through M-Pesa. The ODPC rejected that. Agreeing to a payment being processed is not agreeing to be marketed to.
The same idea shows up in court. Mutie Advocates summarises a 2026 High Court matter, Jaggys (Kienyeji Chicken) v Gichunge, in which a buyer complained that a chicken seller took his number from the M-Pesa payment details and used it to send promotional and feedback messages. The commentary reads the case as confirming that personal data collected during a sale cannot automatically be used for direct marketing.
Being an existing or former customer does not protect you either. In Regus Kenya Limited v Data Protection Commissioner (2025), a former client received marketing after the relationship ended. The High Court upheld the Commissioner’s findings, though it reduced the penalty because it was a first offence.
The scale is growing. One law firm’s 2026 guide notes that the ODPC determined 96 complaints in 2025. Under section 63 of the Data Protection Act, penalties can reach KES 5 million or 1% of annual turnover, whichever is lower, and complainants can also be awarded compensation.
A note on scope: this is general information for business owners, not legal advice. If you have received a complaint or a notice, speak to an advocate who handles data protection.
The rules, in plain language
Purpose matters. You collected the number to complete a sale. Using it to promote your next sale is a different purpose, and it needs its own basis, usually consent.
Consent has to be real. Clear, informed and specific. A tick box buried in terms, or silence, does not count.
“Stop” means stop. People have a right to object to direct marketing. According to BA Advocates’ review of ODPC decisions, carrying on after someone objects or asks for deletion is a separate breach on its own.
It is not only SMS. The same review points to Regulation 14 of the Data Protection (General) Regulations, 2021, which treats direct marketing as covering SMS, WhatsApp messages, emails and even targeted online advertising that uses personal data.
A cleanup you can finish in a week
Day 1 to 2: audit where each number came from. Anything pulled from M-Pesa statements, a till report, a bought list or a WhatsApp group should be parked. Stop promoting to it until you have permission.
Day 3: ask again, properly. Send one message to your existing customers, or better, ask in person or at checkout. Use plain words about what they will get and how often. A separate “yes” beats a pre-ticked box every time.
Day 4: keep a record. Who agreed, when, how and to what wording. A spreadsheet is a fine start. If a complaint arrives, this is the document that decides how it goes.
Day 5: give everyone a way out. Every promotional message should say how to stop, and stopping should actually work within a day or two, not after the next campaign.
Day 6 to 7: separate what you send. Receipts, delivery updates and appointment reminders are one thing. Discounts and new arrivals are another. Keep the lists apart, and ask your SMS or WhatsApp provider how they store and prove opt-in.
This does not kill your marketing
Your list will probably shrink. We think that is fine. A list of 2,000 people who said yes tends to behave better than 20,000 who never did, and it stops one angry customer from turning into a regulator’s letter.
Good ways to build an opted-in list include a sign-up on your website, a QR code at the till, a form at reception, and ads that send people to a WhatsApp chat. A customer who messages you first has started a conversation, though sending them promotions later still needs their agreement. Our guides to bulk SMS and WhatsApp marketing cover the mechanics.
Frequently Asked Questions
Can I message people who bought from me last year?
Not on the strength of the purchase alone. The decisions above treat a sale as a reason to hold the number, not as permission to market. Ask for consent first.
Does this apply to WhatsApp and email too?
Yes. Direct marketing in the regulations is not limited to SMS. Any message that uses personal data to promote something is in scope.
What happens if someone complains about me?
The ODPC investigates and can issue enforcement notices, penalties of up to KES 5 million or 1% of turnover (whichever is lower), and compensation to the complainant. Having consent records ready is the best protection you can have.
WANT A LIST YOU CAN MESSAGE WITHOUT LOOKING OVER YOUR SHOULDER?
We build the opt-in forms, WhatsApp flows and SMS campaigns that grow a clean list
Tell us how you collect customer numbers today and we will show you where the gaps are and how to close them.
+254 792 672500 · sales@metadata.co.ke · Serving Kenya & East Africa
