How to complain to the ODPC about misuse of your betting data
A data subject can file a complaint with the Office of the Data Protection Commissioner (ODPC) through its online portal, under section 56 of the Data Protection Act. Write to the operator first, collect your evidence, attach copies of supporting documents, and keep money disputes out of the complaint.
What the ODPC deals with
The Office of the Data Protection Commissioner regulates how personal data is processed in Kenya. Its website lists the Commissioner's functions as regulating the processing of personal data, protecting the privacy of individuals and giving data subjects rights and remedies. A betting account holder is a data subject, and the licensed operator is the data controller, as set out in the guide to personal data terms for gambling accounts.
The gambling rules point the same way. An online operator's approved gambling control system must include data protection measures under the Data Protection Act (Gambling Control Act s.68(2)(h)). The conduct regulations require data collection and processing to comply with that Act (r.96(1)).
What counts as misuse of betting data
The conduct regulations give two clear anchors. A licensee may collect and process data only for purposes directly related to administering the gambling operation (r.96(2)), and personal data must not be used for any form of marketing without the participant's prior consent (r.96(3)). The table maps common situations to those anchors.
| Situation | Rule to point to | Where it belongs |
|---|---|---|
| Marketing messages continue after you refused consent | Conduct regulations r.96(3) | Operator first, then ODPC |
| Data used for a purpose unrelated to running the gambling operation | Conduct regulations r.96(2) | Operator first, then ODPC |
| Erasure or access request ignored | Your own dated request; see the account and data deletion guide | Operator first, then ODPC |
| Disputed balance, void bet or late payout | Not a data matter | Operator complaints route or the GRA |
| Message pretending to be the operator | Possible phishing; see recognising betting phishing SMS | Secure the account first |
Steps before you file
- Write to the operator using the data contact in its terms or your logged-in account, describe what happened and ask for a written answer. Keep the date and any reference number.
- Collect evidence: screenshots of the marketing messages with sender and time, your consent settings, your erasure or access request and every reply.
- Note which identity documents you gave. The operator may hold copies from its identity and proof-of-age checks, so say which data is involved.
- Secure the account if a third party may have used it. The guide on protecting a gambling account from SIM swap lists the steps. Never share a PIN or one-time code with anyone claiming to act for the ODPC.
Filing the complaint
The ODPC page says the online complaint form is at cie.odpc.go.ke, and that you may also visit the office in person. Its address is Britam Towers, 12th Floor, Hospital Road, Upperhill, Nairobi. It lists office hours of Monday to Friday, 8:00 AM to 5:00 PM, and the emails [email protected] and [email protected].
The form instructs complainants to annex copies of supporting documents to substantiate the claim. If you file for another person, provide their authorisation. The office says it treats submitted information with utmost confidentiality.
| Attach | Why |
|---|---|
| Your written request to the operator | Shows what you asked and when |
| The operator's replies, or a note that none came | Shows the operator's position |
| Screenshots of messages or settings | Shows the processing you object to |
| Authorisation, if filing for someone else | Required by the ODPC page |
What to write
State who you are, the operator's name and its licence number, and the data involved. Then give a dated list of events, the rule you think was breached and the outcome you want, such as stopping marketing or confirming what was erased. Use facts, not accusations. The gambling control system guide explains where data protection sits among an operator's duties.
Illustrative example: an account holder wrote on the 1st to refuse marketing, then received three promotional messages on the 3rd, 5th and 9th. The attachments are the request, the operator's reply and three screenshots. The complaint cites r.96(3) of the conduct regulations and asks for the messages to stop.
Keeping the record straight
Keep everything in one folder, named by date. Save the original messages, not only screenshots, and note the phone number or email address that received them. If the operator replies by phone, write down the date, the time and what was said, then send a short email confirming it.
Keep the complaint to one subject. A complaint that mixes a marketing problem, a missing payout and a lost password is harder to read than three separate ones. Send the data part to the ODPC and the money part to the operator's complaints route or the Authority.
After you file, save the confirmation the portal shows, or the date you handed in a paper copy. If the ODPC asks for more documents, answer from the same folder so that your account of events stays consistent. Respond only through contacts printed on the ODPC site, because scammers also pose as officials.
Using the licence details
The licensing application forms ask an applicant for a data protection certificate and a data protection policy. A licensed operator should therefore be able to name its data protection policy when you ask. Quote its answer, or its silence, in your complaint. The register of licensed operators describes the 2025/26 trading period, so check the live GRA register for the current licence status before you name a company.
What the page does not tell you
The ODPC pages read for this guide give no processing timeline and no fee. They also do not describe the possible outcomes of an investigation. Treat any figure quoted by third parties with caution, and read the Data Protection Act itself on Kenya Law for the Commissioner's powers.
Where else to turn
If the harm is financial or relates to play, the ODPC is the wrong body. The Gambling Regulatory Authority toll-free line is 0800-723-770, and the responsible gambling page explains self-exclusion. Gambling is addictive: play responsibly, and only if you are 18 or over.
Questions and answers
Who can file a complaint with the ODPC?
The ODPC page says the complainant must be a data subject or an authorised representative filing under section 56 of the Data Protection Act. If you file for someone else, provide their authorisation.
Does it cost anything or have a deadline?
The ODPC complaint page read for this guide mentions no fee and no processing timeline. Do not assume either. Check the portal when you file and keep the date you submitted.
Do I have to complain to the operator first?
The ODPC page does not say so. Writing to the operator first is still sensible, because it gives you the operator's own account of what it did and a dated record to attach.
Can the ODPC recover my deposit or settle a bet dispute?
The Commissioner's role, as the ODPC describes it, is regulating the processing of personal data and protecting privacy. A disputed balance or bet is a gambling matter. The Gambling Regulatory Authority toll-free line is 0800-723-770.
Is it a data complaint if a stranger got into my account?
Possibly, if the cause was how the operator handled your data. Securing the account comes first: contact the operator, and see the guides on SIM swap and phishing SMS for the steps.
Can I still file a complaint if I have already closed the account?
The ODPC page ties eligibility to being a data subject, not to holding an account. Your data may still be held by the operator, so your closure confirmation and any erasure reply are useful attachments.
Sources
- Office of the Data Protection Commissioner: file a complaint, accessed 2026-10-05
- Office of the Data Protection Commissioner: home page, accessed 2026-10-05
- Gambling Control (Conduct of Gambling Operations) Regulations, 2026, r.96, accessed 2026-10-05
- Gambling Control Act, 2025, s.68(2)(h), accessed 2026-10-05