Receiving a call from a friend saying "some loan company called me about your debt" is one of the most humiliating experiences a Kenyan borrower can face. It damages relationships, affects employment, and causes real psychological harm. What most borrowers do not know is that this practice — known as contact shaming or third-party harassment — is illegal under Kenyan law. This guide tells you exactly what to do, what your rights are, and how to hold lenders accountable.

Is It Actually Illegal? Yes — Here Is the Law

Contacting your friends, family, employer, or any third party about your loan debt without your explicit consent violates multiple Kenyan laws:

1. Data Protection Act 2019 — Section 25 and 26

Your contact list data was collected for the purpose of credit scoring — not for debt collection purposes. Using your contacts data to shame you or pressure repayment through third parties is a secondary processing violation. The Act prohibits processing personal data for purposes incompatible with those for which it was collected.

2. CBK Credit Provider Regulations 2022

Licensed lenders under CBK's Non-Deposit Taking Credit Provider framework are explicitly prohibited from using "unfair, deceptive, or abusive debt collection practices." The regulations specifically prohibit:

• Communicating with third parties about a borrower's debt without the borrower's consent
• Using tactics that amount to harassment, oppression, or abuse
• Publishing or threatening to publish a borrower's debt status

3. Consumer Protection Act 2012

The Act prohibits unfair commercial practices that cause material distress to consumers. Contacting an employer about an employee's consumer debt without consent constitutes an unfair commercial practice.

Step 1: Document Every Incident Immediately

Before you take any other action, document the contact shaming incident in detail. Good documentation is the foundation of any successful complaint.

What to document:

• The name and phone number that called your contact (screenshot the call log if possible)
• The exact date and time of the call
• What was said — write this down verbatim from your contact's account as soon as possible
• The name of the contact who was called (you may need them as a witness)
• Screenshots of any SMS sent to your contacts
• The name of the loan app you have outstanding debt with

If your contact received a WhatsApp message rather than a call, ask them to screenshot it and send it to you. Do not delete any messages.

Step 2: Revoke App Permissions Immediately

Even while pursuing a complaint, prevent further access to your contacts immediately:

1. Go to your phone's Settings → Apps
2. Find the offending loan app
3. Tap Permissions
4. Set Contacts permission to Deny
5. Also deny: Phone, SMS, and Location while you are there

On most Android phones: Settings → Privacy → Permission Manager → Contacts → select the app → Deny.

Revoking permissions stops further reading of your contacts but does not delete contacts they have already accessed. The complaint process addresses that.

Step 3: Send a Formal Cease and Desist to the Lender

Write to the loan app's official contact email with this letter structure. Keep it factual and cite the law:

Subject: Formal Notice — Cease Third-Party Contact / Data Protection Violation

Dear [Loan App Name] Data Protection Officer,

I write to formally notify you that on [date], a representative of your organisation contacted [relationship, e.g., "my colleague"] at [phone number] regarding my outstanding loan account. This contact disclosed my personal debt information to a third party without my consent.

This action constitutes a violation of:

• Section 25 of the Data Protection Act 2019 (secondary processing of personal data)
• CBK Credit Provider Regulations 2022 (prohibited debt collection practices)

I formally demand that you immediately:

1. Cease all contact with any third parties regarding my account
2. Delete all contact information obtained from my phone
3. Confirm in writing within 7 days that you have complied

Failure to comply will result in a formal complaint to the Office of the Data Protection Commissioner (ODPC) and the Central Bank of Kenya Consumer Protection Department.

Your name, registered phone number, account reference

Send this via email to the lender's official support address. Keep a copy of the sent email.

Step 4: File a Complaint with the ODPC

The Office of the Data Protection Commissioner (ODPC) is Kenya's data protection regulator. Filing a complaint is free, takes approximately 20 minutes online, and is far more effective than arguing with the lender directly.

1. Go to odpc.go.ke
2. Navigate to "File a Complaint"
3. Create an account or log in
4. Select complaint type: "Unlawful processing of personal data"
5. Provide:
   • Your name and contact details
   • The name of the loan app (the data controller)
   • Description of what happened (use your documentation from Step 1)
   • Upload any screenshots or evidence
6. Submit — you will receive a case reference number

The ODPC will contact the loan app and investigate. Proven violations can result in fines of up to KES 5 million for the company. Even without a fine, the investigation process typically results in the behaviour stopping.

Step 5: File a Complaint with the CBK

For CBK-licensed lenders (which includes Tala, Branch, Zenka, M-Shwari, and KCB M-Pesa), you can also file a complaint with the Central Bank of Kenya's Consumer Protection Department.

• Online: centralbank.go.ke → Consumer Protection → File a Complaint
• Email: ccpd@centralbank.go.ke
• Phone: 020 286 0000
• Physical: CBK headquarters, Haile Selassie Avenue, Nairobi

Include your case reference number from the ODPC complaint if you have already filed one.

App-by-App: Specific Actions

Tala Kenya

Email: privacy@tala.co — Subject: "Data Protection Complaint — Third-Party Contact"
Tala has a formal data protection process. Reference the Data Protection Act 2019 in your complaint. Tala's official policy prohibits contacting third parties, so complaints citing a specific incident tend to be taken seriously.

Branch Kenya

Email: hello@branch.co — or use in-app complaint system
Branch has a formal complaint escalation path. If in-app support does not resolve within 5 business days, escalate to the ODPC directly.

OKash / Opera Lending

OKash has a documented history of contact shaming — it is on our blacklist. For OKash complaints, go directly to the ODPC — OKash's own complaint process has been reported as unresponsive by multiple Kenyan users.

iPesa, LionCash, and Other Unlicensed Apps

For unlicensed apps, the ODPC is your primary route since the CBK does not regulate them. Also file a report with the Directorate of Criminal Investigations (DCI) — particularly if threats accompanied the contact shaming.

Protecting Yourself Going Forward

• Never grant contacts permission to a loan app if you can avoid it — modern versions of Android allow you to deny this during installation
• Use a secondary phone number for loan app registration if possible
• Warn your close contacts that they may receive calls if you are currently in default — this prevents surprise and allows them to document any calls for your complaint
• Only use CBK-licensed apps — unlicensed apps have far fewer accountability mechanisms

Related Guides on loanapp.co.ke

• Loan App Blacklist
• Switch to a Licensed App
• Check Your CRB Status

Frequently Asked Questions

Can I sue a loan app for calling my contacts?

Yes — under the Data Protection Act 2019, you can pursue civil compensation for unlawful data processing that causes you harm. The ODPC can also impose fines. Speak to a lawyer if the harm has been significant (e.g., job loss due to employer contact).

What if my contacts have already been damaged — can the app undo it?

The lender can and should cease further contact. The ODPC complaint process can result in an order to delete the contact data. The reputational damage to your relationships is a civil harm that can be pursued as a compensation claim under the Data Protection Act.

Does revoking the app's contact permission delete the data they already have?

No — revoking permissions stops future access but does not delete what was already collected. A formal data deletion request under the Data Protection Act is required for that. Include it in your formal letter to the lender (Step 3 above).