Platinum Credit Ordered to Pay KSh400,000 After ODPC Rules on Unsolicited Loan Calls

Platinum Credit, a Kenyan digital lender, has been ordered to compensate a customer KSh400,000 after the national data watchdog found it unlawfully used his personal data to send unsolicited loan promotions.

The ruling by the Office of the Data Protection Commissioner (ODPC) follows a complaint lodged by Samuel Kamau Waweru, who says he began receiving repeated text messages and phone calls advertising loan products — despite never giving consent or submitting his data to Platinum Credit.

According to the ODPC’s determination, Mr. Waweru filed the complaint in November 2024. In it, he alleged that Platinum Credit (or its agents) had been contacting him relentlessly with marketing messages and calls, using his personal information without authorization.

The documents reviewed by the regulator revealed that during one call, a sales agent referenced his vehicle details, information Waweru insists he never shared.

During the investigation, the company initially denied any link to the caller, claiming the person was not its agent. However, the ODPC confirmed the caller was indeed acting on behalf of Platinum Credit.

The Office determined that Platinum Credit had violated multiple provisions of the Data Protection Act 2019, notably the requirement for explicit consent before processing personal data for marketing, and the principle of data minimization.

As a result, the ODPC ordered Platinum Credit to pay Mr. Waweru KSh 400,000 in compensation for distress caused, issued an enforcement notice compelling the company to comply with data-protection obligations and recommended prosecution of the company’s directors for giving false information to the regulator during the inquiry.

Data privacy enforcement

The Platinum Credit case joins a growing list of enforcement actions by the ODPC against companies contravening data-privacy rights. In February 2025, the regulator fined another firm, Zuku (Wananchi Group Limited), KSh 500,000 for continuously sending promotional messages to a former customer who had formally ended service years earlier.

Likewise, previous ODPC rulings have penalized companies for failing to heed requests for data deletion or for using personal data without valid consent.

For customers like Mr. Waweru, the decision underlines the importance of their right to privacy and the legal protections available if companies misuse their data. For businesses, it sends a clear warning: data-privacy laws are being enforced, and failure to comply can lead to substantial financial penalties, not to mention reputational damage.

In its statement, the ODPC emphasized that consent must be explicit and informed before any personal data can be used for marketing purposes, and that companies must respect customers’ rights to opt out or request data deletion.