Loan app privacy & data protection Kenya 2026

What loan apps typically collect

The permissions surface varies by lender and by Android version. Historically, Kenyan app lenders have requested some subset of:

Phone number and IMEI (for identity binding).
SMS access (to read M-PESA balance and transaction messages).
Contacts (historically used for scoring or, in bad cases, for collection outreach).
Installed app list (as a proxy for financial profile).
Device location and metadata.

Post-Google Play policy tightening in 2020 to 2021 and post-Kenya DPA enforcement, the frontier has narrowed. Legitimate lenders should today request only what is necessary for scoring and disbursement.

What the Data Protection Act 2019 requires

The DPA is the umbrella law. Loan apps that process personal data must:

Register as a data controller or data processor with the ODPC.
Collect only for a stated, lawful purpose.
Use data only for that purpose.
Provide a privacy notice at point of collection.
Enable the data subject to access, correct, and (in some cases) delete their data.
Report data breaches.

What the CBK Code prohibits specifically

The CBK Digital Credit Providers Code of Conduct, 2022, extended under the Business Laws (Amendment) Act No. 20 of 2024, explicitly prohibits licensed lenders from:

Debt-shaming: publishing or threatening to publish borrower default status.
Calling third parties in the borrower's phone contacts about the debt.
Making threats of violence.
Misrepresenting a debt as owed to a court.
Calling borrowers outside business hours.
False CRB listing.

These prohibitions apply to CBK-licensed non-deposit-taking credit providers and to microfinance banks. See your rights under the CBK Code for the full list.

What to do if a loan app misuses your data

Preserve evidence. Screenshot the app permissions screen, any messages sent to contacts, any threats received.
Written complaint to the lender. Reference the Data Protection Act 2019 and, if CBK-licensed, the Code of Conduct. Give 15 working days for resolution.
ODPC complaint. File at odpc.go.ke citing the specific alleged breach and attaching evidence.
CBK Consumer Protection. If CBK-licensed, escalate to 0800 720 000.
Google Play report. If the app violates Google Play developer policy (loan-app collection practices), submit a report; Google has enforced against Kenyan lenders before.

Prevention: what to check before installing

Read the app privacy policy. If none, do not install.
Read the permissions requested at install. If it asks for contacts, ask why.
Verify the lender is CBK-licensed via our CBK licence checker. Unlicensed apps have limited ODPC recourse in practice.

Sources

Kenya Data Protection Act, 2019.
Office of the Data Protection Commissioner. Register of data controllers and data processors.
Central Bank of Kenya. Digital Credit Providers Code of Conduct, 2022, extended under Business Laws (Amendment) Act No. 20 of 2024.
Google Play. Developer Program Policies, personal loans category.

FAQ

Can a loan app read my contacts?

Only if you grant contacts permission and the app has a documented, lawful basis under the Kenya Data Protection Act 2019. Even with permission, the app cannot use contacts for third-party outreach on debt: that is prohibited by the CBK Digital Credit Providers Code of Conduct.

What is the ODPC?

The Office of the Data Protection Commissioner is the Kenyan regulator that enforces the Data Protection Act 2019. It receives and investigates complaints about misuse of personal data, including by loan apps.

How do I complain about a loan app misusing my data?

Complain first to the lender in writing with evidence (screenshots). If unresolved, file with the ODPC via odpc.go.ke. If the lender is CBK-licensed, also escalate to CBK Consumer Protection on 0800 720 000.