On January 2, 2026, the Office of the Data Protection Commissioner (ODPC) of Kenya issued a ruling on Complaint No. 1501/2025, ordering MOMENTUM Credit Limited to pay 500,000 Kenyan shillings (approximately USD 3,870) in compensation to the complainant, Mary Ogwena Immaculate.
The complainant stated that she had never been a customer of MOMENTUM Credit and had never consented to the processing of her mobile phone number by the company or its agents. However, between February 25 and May 28, 2025, she received more than 50 promotional SMS messages advertising MOMENTUM Credit’s products. The messages continued to be sent despite her explicit request to cease contact after receiving the initial text. In its defense, MOMENTUM Credit claimed that the relevant numbers did not belong to its official communication channels and that the SMS messages were sent by "rogue agents".
However, the ODPC’s investigation found that these SMS messages explicitly referenced the company’s products and originated from marketing agents hired by the company. The ODPC determined that the company violated Sections 26(c), 30 and 37(1) of the "Data Protection Act", failing to demonstrate a lawful basis for its processing of personal data and failing to respond promptly to the complainant’s objection request. The ODPC particularly emphasized that organizations bear full responsibility for the actions of their representatives or individuals — shifting blame to agents does not absolve a data controller of its legal liability. In addition to the compensation, the ODPC also issued an enforcement notice to the company, requiring it to take corrective measures and ensure ongoing compliance.
This case demonstrates that even if a company claims that SMS messages are sent by third-party agents, the ODPC will still hold the data controller directly liable. A2P SMS service providers must strictly audit the compliance practices of their marketing agents and establish effective mechanisms to respond promptly to users’ opt-out requests.
