Banks, consent and the unsubscribe button: lessons from the latest data fines

In mid-October, HapaKenya reported on a run of enforcement decisions against Kenyan banks by the Office of the Data Protection Commissioner (ODPC). According to the report, Co-operative Bank received an additional KES 50,000 penalty over persistent marketing messages to a customer who had not opted in; a non-customer who received repeated unsolicited emails was awarded KES 250,000; and Family Bank was cited for ignoring unsubscribe requests.

The amounts are modest for a bank. The message is not. Kenya's Data Protection Act applies to direct marketing, and the regulator is acting on complaints from ordinary people.

What the law expects, in plain terms

This is not legal advice, and you should check the Act and ODPC guidance for your situation. Broadly, businesses sending marketing messages are expected to:

• Have a lawful basis, typically consent, for sending marketing to a person
• Identify themselves clearly in every message
• Offer a simple way to opt out, and honour it promptly
• Collect only the data they need, and keep it secure

The current Act caps fines at KES 5 million or 1% of annual turnover, whichever is lower. A pending amendment bill would change that to whichever is higher, according to legal commentary, which would make penalties far more serious for large firms.

Why it matters beyond banks

Banks are visible targets, but the same rules apply to a salon sending SMS offers, a school emailing parents about a new campus, or a property developer blasting WhatsApp broadcasts. Complaints are easy to file. A screenshot of an unwanted message and an ignored "STOP" is all a complainant needs.

Practical rules for every business

1. Keep a record of consent. When and how each person agreed to hear from you.
2. Make unsubscribing one step. A link or a reply word, not a phone call.
3. Honour it immediately. Remove people from every list, not just one.
4. Do not buy lists of personal numbers. Their owners never agreed to hear from you.
5. Say who you are. Your business name in every message.
6. Train your team. Most breaches come from a well-meaning person pressing "send to all".

Pull, not push

The safest marketing is the kind people come to on their own. Short videos on your own social pages, posts with a tracked WhatsApp link that customers choose to tap, and fast replies when they do: none of it involves messaging people who did not ask. With Tari Studio, you make the video, publish it to Facebook, Instagram or TikTok, and conversations start when customers choose. How tracked links work.

Tari Studio's own policy on your data, including your rights under the Kenya Data Protection Act, is set out in our privacy policy.

The trust dividend

Respecting consent is not only about avoiding fines. Customers who chose to hear from you read your messages. Customers who were spammed block you, and tell their friends why.

Make content customers come to.