Co-op Bank Among Lenders Fined Over Customer Data Sharing: Fresh Questions on Privacy in Kenya’s Banking Sector

Why Regulators Penalized Banks for Allegedly Sharing Borrower Data Without Consent

Co-operative Bank of Kenya found itself under scrutiny after Kenya’s data protection regulator reportedly fined several lenders over the alleged unlawful sharing of borrower information, raising fresh concerns about customer privacy and financial data security in the country’s banking sector.

The case, which attracted significant attention within Kenya’s digital finance landscape, reignited debate about how banks and lenders handle sensitive customer information and whether financial institutions are doing enough to comply with modern data protection laws.

According to reports published in 2025, Co-operative Bank was among three financial institutions penalized by the Office of the Data Protection Commissioner (ODPC) over claims that customer information had been shared with third parties without proper legal authorization or customer consent.

While the penalties involved administrative enforcement rather than criminal wrongdoing, the development raised uncomfortable questions about compliance failures within Kenya’s highly regulated financial industry.

What Triggered the Investigation?

The reported regulatory action stemmed from complaints lodged by customers who alleged that their financial information had been improperly accessed or shared during debt recovery and credit referencing processes.

At the center of the controversy was the handling of personal borrower information—data that typically includes names, phone numbers, national identification details, loan status, and repayment history.

Under Kenya’s Data Protection Act of 2019, organizations handling personal information are required to obtain lawful justification before processing or sharing sensitive customer data.

Banks and financial institutions are particularly bound by strict confidentiality standards due to the nature of financial records and the risks posed by unauthorized disclosure.

According to media reports citing the regulator’s findings, some lenders allegedly disclosed borrower information to third parties in ways that failed to meet legal consent thresholds.

Evidence Cited by Regulators

The strongest evidence in the matter reportedly came from findings made by the Office of the Data Protection Commissioner.

According to published reports, regulators concluded that certain financial institutions had processed or disclosed customer information without sufficiently proving informed customer consent.

The regulator reportedly reviewed:

• Customer complaints and formal submissions
• Internal lender communication records
• Documentation surrounding loan recovery procedures
• Consent mechanisms used by banks and digital lenders
• Data-sharing arrangements between lenders and third parties

The ODPC reportedly found that institutions had failed to demonstrate adequate legal justification for some forms of customer data processing.

As a result, administrative fines were imposed.

Co-operative Bank was among institutions mentioned in reports concerning the regulatory action, though public reporting did not suggest criminal fraud or intentional theft of customer information.

Instead, the issue centered on compliance with Kenya’s privacy framework and whether institutions followed lawful procedures before sharing borrower-related information.

What the Law Says

Kenya’s Data Protection Act requires companies collecting personal data to ensure transparency, fairness, and lawful processing.

Organizations are expected to:

• Obtain valid consent where required
• Clearly explain how personal data will be used
• Restrict unauthorized sharing of customer records
• Protect customer information from misuse or exposure

Failure to comply may result in investigations, corrective orders, and financial penalties from regulators.

The law has increasingly become important as Kenya’s financial sector becomes more digital and customer information moves across apps, credit bureaus, lenders, and loan recovery systems.

Privacy experts argue that customer trust in banks depends heavily on confidence that financial records remain confidential.

Co-op Bank’s Position

At the time of reporting, public information surrounding the matter focused largely on the regulator’s enforcement action rather than a detailed public response from each affected institution.

Importantly, there is no publicly available evidence suggesting that Co-operative Bank executives orchestrated deliberate misconduct or that customer funds were stolen.

Instead, the reported matter revolved around regulatory compliance and whether privacy obligations under Kenyan law had been fully met.

This distinction is critical.

A data protection fine differs significantly from corruption, embezzlement, or criminal fraud.

However, for customers, concerns about who has access to personal financial information remain serious regardless of whether wrongdoing is criminal or administrative.

Bigger Questions for Kenya’s Banking Sector

The incident raises wider questions about how securely Kenyan financial institutions manage personal data.

As more customers shift to mobile banking, digital loans, and online financial services, concerns over privacy breaches continue to grow.

Financial institutions increasingly rely on third-party systems, credit reference bureaus, digital collection agencies, and outsourced technology services—creating additional risks around how customer information is stored and shared.

For regulators, the case signals tougher enforcement of Kenya’s privacy laws.

For customers, it serves as a reminder to closely review consent agreements signed during loan applications and digital banking registration.

And for banks, the message appears increasingly clear: compliance with privacy law is no longer optional.

Evidence and Sources Used: Media reports citing findings by Kenya’s Office of the Data Protection Commissioner (ODPC), enforcement actions reported in 2025, and Kenya’s Data Protection Act, 2019.