• The ruling carries significant implications for schools and institutions across Kenya. It reinforces the principle that children’s privacy is inviolable and that parental consent must be respected at all times.

On January 19, 2026, the Office of the Data Protection Commissioner (ODPC) delivered a landmark ruling against Nairobi Academy, ordering the school to pay Ksh. 637,500 in compensation after it unlawfully published a minor’s exam results and name in a national newspaper advertisement.

The case stemmed from an incident on August 21, 2025, when the school placed an advertorial in the Daily Nation showcasing the child’s performance as part of a marketing campaign to attract new students.

The parent of the child, whose identity has been withheld to protect privacy, had explicitly objected to the use of the minor’s personal data, and Nairobi Academy had previously promised in 2023 not to repeat such a disclosure.

Despite this, the school went ahead and exposed the child’s sensitive information to the entire country. Presiding over the matter, Data Commissioner Immaculate Kassait, SC, MBS, described the act as “a deliberate and aggravated violation,” stressing that children’s data is highly sensitive and must never be exploited for commercial gain.

“The respondent knowingly disregarded the parent’s objections and exposed the minor’s sensitive data to the entire country, permanently,” she said in her ruling.

Read More

  1. Valentine’s Day Commands Attention, But Misses the Point
  2. Kikopey Holds Nakuru’s Travelers, Have You Been There?
  3. Campus Choices Show Courage in Commitment

Kassait emphasized that institutions entrusted with minors must uphold the highest standards of privacy and consent, warning that any future breach of children’s privacy would attract severe consequences.

The ODPC found Nairobi Academy in violation of several provisions of the Data Protection Act, 2019. These included Section 25, which requires that personal data be processed lawfully, fairly, and transparently; Section 26, which protects the rights of data subjects against unauthorized disclosure; Section 30, which mandates informed consent, particularly for minors; and Section 41, which provides special protection for sensitive personal data such as children’s exam results.

By breaching these clauses, the school not only disregarded the law but also acted in bad faith, given its prior commitment to safeguard the child’s privacy.

The ruling carries significant implications for schools and institutions across Kenya. It reinforces the principle that children’s privacy is inviolable and that parental consent must be respected at all times.

For schools, the judgment is a stern reminder to adopt strict data protection policies and ensure compliance with the law.

For parents, it offers reassurance that they can hold institutions accountable when their children’s rights are violated.

And for society at large, it sets a precedent that repeat offenders will face harsher penalties, underscoring Kenya’s growing commitment to safeguarding privacy in the digital age.

By holding Nairobi Academy accountable, the ODPC has sent a clear message: children’s personal data cannot be turned into billboards for profit.

The fine, though monetary, is symbolic of a broader shift in Kenya’s enforcement of data protection laws, ensuring that the rights of minors are protected and respected across every sphere of public life.

Stay connected with us on WhatsApp and TikTok for instant updates and breaking news as it happens.