The ODPC fined Roma School (Nairobi) KES 4,550,000 for publishing photographs of minor pupils on its social-media platforms for marketing purposes without the consent of their parents or guardians, processing children's personal data without a lawful basis.

The highest of the three penalties issued on 26 September 2023 and the first Kenyan determination addressing the processing of children's personal data. It confirms that the heightened protection for minors under the Data Protection Act 2019 requires verifiable parental consent before a child's image may be used for institutional marketing, an important signal to schools and child-facing organisations.