If borrowers default on their payments or don't pay them on time, digital lending companies have been warned against contacting the relatives and friends of the people they borrowed money from.

The platforms often ask their customers to provide the contact information of close friends or family members when enrolling for the loans so that they can readily find them in the event of defaults.

The lending companies continuously call and text the contacts above in the case of a default or late payment, pleading with them to "remind" the loan seekers to settle their debts.

Sometimes, the lending companies threaten to self-clear the loans if they don't give their clients' associates' identities to Credit and Reference Bureaus (CRBs).


Immaculate Kassait, the data protection commissioner, points out that since the lending companies only committed to transfer money to loan applicants and not their family or friends, such actions are unlawful.

"Why should they call strangers who have never requested financial assistance? In an interview with the Nation, Kassait claimed they should engage with their clients rather than those connected to them.

The change comes after Mulla Pride Ltd, a digital credit provider (DCP) that runs the mobile lending applications KeCredit and Faircash, was fined Ksh—2.98 million for disclosing loan applicants' names and contact details to outside parties.

The Office of the Data Protection Commission (ODPC) reported 40 Digital Credit Providers (DCPs) for alleged personal data breaches in October 2022.


A data breach makes private, delicate, or protected information accessible to unauthorized people. Additionally, files in a data breach may be viewed or distributed without authorization.

Following public objections regarding the handling of personal data, a preliminary documentary evaluation of the 40 digital lenders was scheduled to take place.