The High Court of Kenya has ordered telecommunications operator Safaricom to pay KES 9.9 million in damages for a data breach that compromised customer information, in a ruling that legal experts say strengthens the enforcement of the country's data protection law. The judgment, delivered by Justice John Mativo, found Safaricom liable for failing to protect the personal data of its clients, which was exposed in a breach reported in 2026.

The court determined that the company's actions constituted a violation of the Data Protection Act, 2019, and awarded the compensation to the affected customers. The ruling comes as Kenya's Office of the Data Protection Commissioner intensifies scrutiny of how corporations, particularly in the financial and technology sectors, handle sensitive user information. Safaricom, which is majority-owned by Vodacom Group and the Kenyan government, is the dominant mobile network operator and the provider of the ubiquitous M-Pesa mobile money service.

The data breach case represents a significant test of the legal framework established by the 2019 Act. "This ruling sends a clear message to data controllers and processors about their obligations," said a Nairobi-based privacy lawyer who requested anonymity as they were not directly involved in the case. "The magnitude of the fine, while not the largest possible, establishes a precedent for compensation and holds a market leader accountable." The judgment is likely to be studied by regulators and companies across East Africa, where digital financial services have proliferated but data governance frameworks are still maturing.

The court's decision emerges amid other operational challenges for Safaricom's digital services. Recently, users reported the disappearance of the 'Lipa Na M-PESA' payment feature from the SIM Toolkit menu on their phones, causing confusion among merchants and consumers reliant on the service for daily transactions. The company attributed the issue to a technical update. "We are aware that the Lipa na M-PESA feature is missing from the SIM Toolkit menu and are working to resolve this," a Safaricom spokesperson said, according to a statement carried by local media.

Separately, the telco has been enhancing its 'Pochi la Biashara' digital business suite, a service tailored for micro-entrepreneurs, with a noted uptake among women traders. This development underscores the dual narrative surrounding Africa's fintech giants: their rapid innovation and scaling of financial inclusion, juxtaposed with growing regulatory and societal demands for robust consumer protection, data privacy, and system reliability. The KES 9.9 million penalty, while a fraction of Safaricom's annual revenue, marks a pivotal moment in balancing these dynamics within Kenya's digital economy.