The ODPC imposed a penalty of KES 5,000,000, the maximum then available under the Act, on Oppo Kenya for using a complainant's photograph on its Instagram account for commercial purposes without consent, contrary to section 37 of the Data Protection Act 2019, and for failing to adopt a data protection policy or internal complaints mechanism despite a prior enforcement notice.

The first penalty notice ever issued under Kenya's Data Protection Act 2019, marking the ODPC's transition from registration to active enforcement. It signalled that the maximum statutory penalty would be reserved for controllers that ignore enforcement notices, and confirmed that ordinary commercial social-media use of an identifiable person's image requires consent under section 37. It set the template for the wave of ODPC determinations that followed in 2023.