DTB Kenya and Uganda Ordered to Pay KSh 500,000 for Breaching Kenyan Buyer’s Information Rights
In a landmark ruling, the Workplace of the Information Safety Commissioner (ODPC) has ordered Diamond Belief Financial institution (DTB) Kenya Restricted and its Ugandan subsidiary to collectively pay a Kenyan buyer KSh 500,000 in compensation after discovering the banks in breach of the Information Safety Act.
The dedication, issued final week, stems from a criticism filed by a Kenyan girl who was denied entry to her personal financial institution statements by DTB Kenya whereas concurrently receiving unsolicited monetary info belonging to a 3rd occasion – info that DTB Kenya claimed had been despatched in error by DTB Uganda.
Based on the ODPC findings, DTB Kenya maintained an lively account for the complainant but repeatedly refused to offer her with statements and transaction information. Worse, the financial institution positioned her quantity on its inside “Do Not Contact” listing, successfully slicing her off from SMS notifications and alerts from Might 2025.
In a weird twist, the complainant started receiving account statements and delicate monetary particulars of one other buyer, a revelation that left her questioning the financial institution’s knowledge dealing with processes. DTB Kenya’s defence? The third-party statements had been mistakenly dispatched by DTB Uganda.
The complainant instructed investigators she had by no means set foot in Uganda, by no means opened an account there, and had no relationship by any means with the sister financial institution. The incident, she mentioned, shattered her confidence in DTB Kenya’s programs and controls. Regardless of elevating the problem as early as 2022, the issue endured unresolved for 3 years.
“Think about attempting to run your life and enterprise whereas being locked out of your personal cash information, then getting another person’s non-public banking particulars as an alternative,” the complainant mentioned in her submission. “It precipitated me critical monetary misery and embarrassment.”
The ODPC faulted DTB Kenya for unlawfully processing the complainant’s private knowledge, failing to facilitate her proper of entry, and breaching the ideas of knowledge accuracy and safety. DTB Uganda was individually cited for the illegal disclosure of one other buyer’s knowledge to an unauthorised particular person.
In its ruling, the Commissioner ordered each entities, although legally separate, to pay the KSh 500,000 compensation, highlighting the shared accountability beneath the broader DTB Group.
Notably, the investigation required cross-border collaboration between Kenya’s ODPC and Uganda’s Private Information Safety Workplace (PDPO), marking one of many clearest demonstrations but of regional enforcement cooperation in East Africa.
Information Safety Commissioner Immaculate Kassait emphasised the importance of the case: “Kenyans’ private knowledge should be protected wherever it’s processed within the area. This ruling sends a robust message to monetary establishments working throughout borders that they can not conceal behind separate authorized entities when rights are violated.”
The ODPC has given the 2 banks 14 days to adjust to the compensation order and rectify the breaches, together with restoring the complainant’s full entry and eradicating her from any inside block lists. Neither DTB Kenya nor DTB Uganda had issued a public assertion on the ruling on the time of going to press. The case is more likely to be carefully watched by different cross-border establishments as regulators throughout the area tighten the online on knowledge safety compliance.
