Nairobi, April 13 -- With well over six years into the operation of the Data Protection Act, 2019, and with the Office of the Data Protection Commissioner (ODPC) steadily asserting its enforcement mandate through a growing body of determinations, one message is clear; organisations handling personal data must do more than adopt policies and issue assurances of compliance.

They must demonstrate that their systems work in practice and that compliance is real, accessible, and effective from the perspective of the individual.

A recent decision by the ODPC issued on February 15, 2026 involving Wananchi Group (Kenya), trading as Zuku Fibre Kenya, illustrates the risks companies face where systems exist on paper but fail in operation.

The ODP...