By Michelle Ndaga
Kenya’s largest telecommunications company, Safaricom PLC, is set to stand trial in the High Court over the alleged unauthorized sharing of personal data belonging to 11.5 million subscribers, after out-of-court settlement negotiations with the complainants collapsed last week.
The case stems from a 2023 data breach in which two former Safaricom managers allegedly transferred sensitive customer information including names, ID numbers, phone contacts, location data, and gambling records to businessman Benedict Kabugi Ndung’u. The data was reportedly resold to a sports betting company for commercial use without customer consent.
Hearings are scheduled to begin on October 23, 2025, with plaintiffs seeking orders for the complete destruction of the compromised data and accountability for the privacy violations. They argue that Safaricom failed in its duty to protect subscribers’ personal information under Kenya’s Data Protection Act of 2019.
Safaricom, however, maintains that it took immediate corrective measures, including terminating the implicated employees, tightening internal controls, and strengthening its data protection systems. The firm insists that the breach was an isolated act of misconduct by rogue staff members and not a systemic failure.
