Data Is Not Collateral: Betika Fined KSh 250,000 for Abusing Customer Data in Account Deletion Dispute

In a landmark ruling that will reverberate across Kenya’s digital economy, Betika has been ordered to pay KSh 250,000 in compensation after unlawfully frustrating a customer’s right to delete his account. The determination, issued by the Office of the Data Protection Commissioner (ODPC), sends a clear and overdue message to corporates: compliance theatre will no longer be tolerated.

The case arose in June 2025, when Bosco Otieno, a Betika customer, formally requested the permanent deletion of his betting account. What should have been a routine exercise of a data subject right quickly escalated into a regulatory test case. Betika declined to delete the account unless Otieno provided a copy of his national ID and three months of M-Pesa statements, citing anti–money laundering (AML) obligations.

On the surface, the company’s argument appeared familiar—and convenient. AML compliance has increasingly become the all-purpose justification for expansive data collection across fintech, gaming, and digital platforms. But the ODPC drew a firm line between legitimate verification and data overreach.

In its analysis, the regulator acknowledged that requesting an ID for identity verification could be reasonable. However, it found Betika’s blanket demand for three months of financial transaction data to be excessive, intrusive, and unrelated to the narrow purpose of closing an account. This, the ODPC ruled, violated the data minimisation and purpose limitation principles enshrined in Kenya’s Data Protection Act.

Read Also: Betika Launches Nationwide Giveaway With Prizes Worth Over Ksh 100 Million

The determination goes further than a simple fine. The ODPC found Betika liable, ordered the issuance of an enforcement notice, and explicitly recognised that Otieno’s statutory rights as a data subject had been unlawfully restricted. In doing so, the regulator affirmed a critical principle: companies do not own customer data—customers do.

From a business perspective, this ruling is a warning shot. Kenya’s digital platforms—particularly betting firms, fintechs, and telcos—have built business models that thrive on deep behavioural and financial data. But the era of collecting “just in case” data, or using compliance as a shield for retention and profiling, is drawing to a close.

The financial penalty of KSh 250,000 may appear modest. The real cost, however, lies in the precedent. This decision clarifies that AML obligations do not override data protection rights by default. They must be proportionate, specific, and purpose-bound. Anything else is regulatory abuse.

For consumers, the ruling is empowering. It affirms that requesting account deletion is not an invitation for interrogation, nor a licence for companies to rummage through personal financial histories. For businesses, it signals a shift toward accountability by design, where systems must be built to respect exit rights as much as onboarding.

More broadly, the Betika decision marks a maturation of Kenya’s data protection regime. The ODPC is no longer a passive arbiter—it is becoming an active market regulator shaping corporate behaviour. Firms that ignore this reality risk not just fines, but reputational damage and escalating enforcement.

In the digital economy, trust is currency. This ruling makes one thing clear: data hoarding erodes trust, and trust erosion now carries a price tag.

Read Also: Betika Rewrites the Jackpot Playbook with a Deadline-Driven KSh 50 Million Win