The ODPC fined Mulla Pride Limited, a digital credit provider, KES 2,975,000 for unlawfully obtaining the names and contact details of borrowers' third-party referees from borrowers' phones and using them to make threatening debt-collection calls and messages, processing personal data without a lawful basis and outside the purpose for which it was collected.

One of three penalties announced on 26 September 2023 and the leading early Kenyan determination on abusive data practices by digital lenders, a sector that generated the majority of complaints to the ODPC in its first enforcement cycle. It establishes that harvesting and weaponising third-party contacts for debt collection is unlawful, sanctionable processing, shaping compliance expectations across the fast-growing digital-credit market.