What to do after a betting company data breach in Kenya

Treat the breach notice as real until the operator says otherwise: change the account password, check your mobile money statement, expect phishing messages that quote your details, and keep dated copies of everything. Complaints about data handling go to the Office of the Data Protection Commissioner (ODPC).

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-15

What a breach means for you

A personal data breach is a security failure at the operator, not something you caused. The operator is the data controller for your account, and its approved gambling control system must include data protection measures under the Data Protection Act (Gambling Control Act s.68(2)(h)). The terms are explained in the guide on personal data terms for gambling accounts.

Operators also have security duties of their own. The conduct regulations require an online licensee to keep its platform secure from cyber-attacks and hacking, and to maintain an incident response report that registers breaches, downtime or fraudulent digital activity (r.50(1) and (3)).

What was probably exposed

You will not always be told exactly what was taken, so work from what the operator holds. Registration and identity checks usually put several kinds of data on file, as described in the guide to identity and proof-of-age checks. The table maps each kind to the risk it creates and your first response.

The first hour

1. Change the account password to one you use nowhere else. Do this by opening the operator's app or website yourself, not through a link in a message.
2. Change the password on any other account that used the same or a similar password, starting with your email.
3. Log out of other sessions if the account offers that option, and check your registered phone number and email for changes.
4. Look at your mobile money statement for payments you did not make. If you find some, follow the steps in the guide on what to do if a betting account is hacked.
5. Never give a PIN or one-time code to anyone, including a caller who says they are from the operator or the ODPC.

The weeks that follow

Stolen details are often used later, not at once. Expect messages that quote your name or a real transaction to look convincing, and read the guide on recognising betting phishing SMS before you act on any of them.

If your ID number was among the data, a SIM swap becomes a more serious risk, because it lets someone receive your codes. The guide to protecting a gambling account from SIM swap lists what to ask your mobile provider.

Who must report, and who complains

The two routes at the ODPC are different, and mixing them up wastes time. The table sets them side by side.

The breach form asks the controller for the cause, the number of people affected, the data types, remedial actions and whether data subjects were told. You, as an account holder, can use that list as a checklist of questions to put to the operator.

Reporting to the regulator

The gambling regulator is a separate body from the ODPC. In the licensing form for a gambling software or platform, an applicant declares that it will report any material incident, with a security breach given as an example, to the Gambling Regulatory Authority within 24 hours of discovery. That is a declaration in an application form, so do not read it as a deadline written into the Act.

The Authority's toll-free line is 0800-723-770. Use it for gambling-side concerns such as a lost balance. The ODPC route is covered step by step in the guide on how to complain to the ODPC about betting data misuse.

Records to keep

Keep the breach notice, with the date you received it and the channel. Save screenshots of your account settings, your mobile money statement for the period, and every reply from the operator. Write down phone calls with the date, time and what was said.

Illustrative example: you receive a breach notice on the 10th and change your password the same day. On the 14th you receive an SMS quoting your correct name and asking you to confirm a withdrawal. Your folder then holds the notice, the SMS screenshot and the date of your password change, which is the evidence a complaint to the ODPC would attach.

Limits and what to avoid

Do not pay anyone who offers to recover your data or your funds. Do not post your account details in public groups while asking for help. The ODPC pages read for this guide give no fee, processing time or outcome for complaints, so treat any figure quoted elsewhere with caution.

If you want your data removed from the operator's systems, the deletion guide, how to delete a betting account and personal data, covers the request. Gambling is addictive: play responsibly, and only if you are 18 or over. Support is on the responsible gambling page.