Can my ex-boss stop me from joining a competitor? Non-compete Clauses Kenya
Have you ever felt trapped in a toxic, dead-end job, terrified to leave because of a restrictive document you signed when you were desperate? Many employees in Kenya sign…
In this article
That Quick Email Forward Just Cost KES 262,500: The Hidden Danger of Sharing Customer Data
You receive a promising CV and forward it to a partner. You pass a warm sales lead to a trusted vendor. You send a client intake form to an external consultant.
It happens hundreds of times a day in Kenyan businesses. It feels like basic networking. But according to a recent ruling by the Office of the Data Protection Commissioner (ODPC), that quick click of the “forward” button is entirely enough to land your business in serious legal trouble.
Takeaway: Routine office habits carry hidden regulatory risks. The simple act of forwarding a client document or CV to a third party can now trigger massive data protection fines.
The CV that triggered an investigation
The ODPC recently penalized a recruitment firm, Brites Management, for what many would mistakenly call standard industry practice.
A job seeker applied for a Legal Assistant position through the firm. Sometime later, she was contacted by a completely different law firm. Startled, she asked how they got her details, and they admitted the recruiter had passed her CV along.
She filed a complaint with the ODPC. The regulator investigated and slapped the recruitment firm with a KES 262,500 fine.
Why? Because collecting someone’s data for one specific reason doesn’t give you a blank check to share it with whoever you think might be interested.
Takeaway: Collecting personal data for one specific purpose does not give your business permission to share it or reuse it for another.
Where the business went wrong
The ODPC’s ruling dismantled several common excuses businesses use when handling data, highlighting three massive operational blind spots:
- The right to know: The applicant had a fundamental right to know her data was being shopped around. By keeping her in the dark about the onward transfer, the business violated Section 26(a) of the Act.
- The “Industry Standard” myth: The recruiter argued that sharing CVs with prospective employers is just how recruitment works. The ODPC disagreed. You must have a distinct, lawful basis to share someone’s personal data with a third party. “It’s what we do” is not a legal defense.
- The buried privacy policy: Stashing a privacy policy on your website or burying a link in an email signature is no longer enough. The Data Protection Act requires you to actively notify people about exactly who will be looking at their information before or at the moment you collect it.
Takeaway: “Standard industry practice” is not a valid legal defense. Businesses must actively and clearly inform people about third-party data sharing before the data is collected.
Opening a can of worms
The case proves that a single grievance can crack open your entire back-office operation.
The ODPC didn’t just look at the forwarded email. While investigating the complaint, the regulator noticed the company wasn’t even registered as a data controller or processor, which is a baseline legal requirement in Kenya. Along with the hefty fine, the ODPC gave them a strict 14-day deadline to get legally registered.
One annoyed jobseeker exposed bad notices, a lack of legal basis, and a glaring registration gap all at once.
Takeaway: A single privacy complaint often triggers a broader regulatory audit. If the ODPC investigates a minor issue, they will also look for major gaps like missing compliance registrations.
Who needs to pay attention?
While this case centered on a recruiter, the precedent hits almost every sector. You are carrying the exact same risk if you are:
- A B2B consultant passing client leads to other service providers.
- A real estate agency sharing inquiries with independent brokers.
- A school passing parent contact lists to external uniform vendors.
- A tech startup sharing user onboarding data with affiliate partners.
Takeaway: This is not just an HR problem. Any business that passes customer, student, or user details to external vendors, partners, or brokers is actively carrying data protection risk.
How to fix your workflow
Data breaches aren’t always caused by cybercriminals hacking into mainframes. More often than not, they happen because someone in the office forwarded a file without asking permission first.
You don’t need to halt your operations, but you do need to align your daily habits with the law. Look closely at your website forms, your intake contracts, and your daily workflows. Are you explicitly telling people upfront where their information is going? And more importantly, does your actual day-to-day sharing match the promises you made when they first clicked “submit”?
If the answer is no, it is time to fix your paperwork before a forwarded email becomes a regulatory nightmare.
Takeaway: Audit your daily data journey. Ensure the reality of how your staff shares information strictly matches the promises written in your intake forms and privacy policies.
Tools for this topic · Data Protection
General information, not legal adviceThis article explains the law in general terms and does not create an advocate–client relationship. For advice on your situation, .
Founder & Lead Advocate
Herman advises founders, businesses and families on company, commercial, property, succession and data protection matters in Kenya, and writes these guides to make the law easier to act on.
Managing this from abroad?
Turn the guidance into a remote Kenyan legal route.
Use the Diaspora Desk to organise documents, verification and the right next step for a Kenyan property or estate matter.
