Affirming existing jurisprudence, the High Court of Kenya ruled that complaints under the Data Protection Act, 2019 (DPA) ought to be first handled by the Data Commissioner. In a recent alert, we detailed how the Office of the Data Protection Commissioner (ODPC) had begun exercising its wide-ranging powers to enforce the DPA provisions. Long before this, data subjects had made attempts to seek compensation from courts in relation to perceived violations of their rights under the DPA. In several decisions, Kenyan courts have generally affirmed that data subjects ought to exhaust the complaints mechanisms available to them under the DPA before approaching the court. The most recent of these decisions is the High Court at Naivasha’s ruling in Mwangi & another v Naivasha County Hotel t/a Sawela Lodges (Petition E003 of 2021) (the Petition).