CJ’s Told to Pay Sh75,000 for Sending Man Unauthorised Texts

CJ’s has been ordered to pay Sh75,000 in compensation after Kenya’s data regulator found it unlawfully sent promotional messages to a customer without consent.

The Office of the Data Protection Commissioner ruled that the restaurant chain breached the Data Protection Act by processing personal data without a lawful basis. The complaint was filed by Steve Onwonga Omwenga, who said he received three promotional text messages in September 2025 advertising CJ’s delivery services, despite never providing his contact details or agreeing to receive marketing communication.

Mr Omwenga lodged his complaint in October 2025. He said that the messages lacked an opt-out option and that the restaurant had no authority to use his personal information. After attempts to resolve the matter directly with the company were unsuccessful, he sought compensation for the repeated contact.

In its response, CJ’s said the messages formed part of a festive-season campaign promoting free delivery services. The company maintained that there was no malicious intent and described the incident as an isolated error. It said it had taken corrective action after the complaint, including deleting Mr Omwenga’s number from its records, issuing an apology and offering him a Sh10,000 dining voucher.

The Commissioner found that the company had processed personal data without consent and failed to meet transparency requirements. The ruling said that consent is required before any personal data is used for marketing purposes and that individuals must be given a clear opportunity to object. While noting the apology and goodwill gesture, the regulator concluded that these steps did not remove the company’s legal responsibility.