Betting firm Betika has been ordered to pay KSh 250,000 after unlawfully refusing to delete a customer’s betting account, in a ruling that delivers a sharp warning to companies that hide behind compliance to overreach into users’ personal data.
The determination, issued by the Office of the Data Protection Commissioner, arose from a complaint filed by Bosco Otieno, who in June 2025 formally requested the permanent deletion of his Betika account.
Instead of honouring the request, Betika declined to close the account unless Otieno submitted a copy of his national ID and three months of M-Pesa statements, citing anti money laundering requirements.
The regulator rejected that justification.
In its ruling, the ODPC found that while requesting an ID to confirm identity may be reasonable, demanding three months of personal financial records for the sole purpose of closing an account crossed a legal line.
The Commissioner ruled that the request was excessive, intrusive, and unnecessary, and had no clear connection to the purpose of deleting a betting account.
The ODPC held that Betika’s actions violated core principles of the Data Protection Act, specifically data minimization and purpose limitation, which require organisations to collect only what is strictly necessary and only for a clearly defined purpose.
“The blanket demand for financial statements was unjustified,” the ruling states in substance, noting that compliance obligations cannot be used as a pretext to harvest or retain sensitive personal data.
The decision sends a strong signal to betting firms, digital platforms, and financial services companies that account deletion is a right, not a negotiation.
Users are entitled to exit platforms without being forced to surrender unrelated or excessive personal information.
The ODPC also underscored that anti money laundering rules do not override data protection rights, and that companies must demonstrate proportionality when invoking compliance requirements.
For Kenyan users, the ruling is a major win.
It confirms that:
-
You have the right to close your account
-
You do not have to justify your decision
-
Companies cannot trap you using invasive data demands
-
Compliance laws cannot be misused to deny basic rights
For companies, the message is equally clear.
Data protection violations now carry real financial consequences.
The Betika ruling adds to a growing list of enforcement actions by the ODPC, showing that the regulator is willing to challenge powerful digital businesses and enforce user rights where companies overstep.
As online betting, lending, and digital services continue to expand, the decision sets a firm boundary on how far companies can go in the name of regulation.
Your data is not collateral.
And leaving a platform should not come at the cost of surrendering your privacy.
