Debt collection in Kenya is not a lawless space, and the belief that it is costs creditors money. When a collector crosses a line, the debt does not become easier to recover — it becomes contested, the creditor's name ends up in a complaint, and a recoverable balance turns into a liability.
The lines that are not negotiable
Some conduct is prohibited outright, whether or not the debt is genuinely owed.
- Threatening arrest or criminal prosecution for a civil debt. Non-payment of a commercial debt is not a criminal offence in Kenya.
- Presenting yourself as a police officer, court official or auctioneer when you are not one.
- Disclosing the debt to an employer, family member, neighbour or WhatsApp group. This is a Data Protection Act breach regardless of intent.
- Threatening or using violence, or damaging property.
- Contacting a debtor at unreasonable hours or with a volume of calls that amounts to harassment.
- Seizing property without a court order and a licensed auctioneer acting on it.
The Data Protection Act changed the economics
Since 2019, personal data used in collection has been regulated. A creditor is the data controller; a collection agency acting on its instructions is a processor. That relationship needs a written agreement, and the creditor remains accountable for what the agency does with the data. Publishing a debtor's details, or bulk-messaging their contact list, exposes the creditor first.
The creditor is accountable for the agency's conduct. Choosing a cheap collector is a governance decision, not a procurement one.
What compliant recovery actually looks like
A compliant process is slower to start and faster to finish. Contact is made with the named debtor. The balance and its basis are explained. The debtor is given a chance to dispute it, and a genuine dispute pauses collection until it is resolved. Where the debtor can pay something, an arrangement is written down with dates and amounts. Every contact is logged, because the log is what protects both sides later.
If a debtor complains
Take the complaint in writing, pause collection on the account, and investigate against the contact log. If the complaint is founded, say so and correct it. If it is not, respond with the record. Either way, the Office of the Data Protection Commissioner and the courts will look first at whether you had a process.
The practical test
Before any contact goes out, ask whether you would be comfortable if it were read aloud in court, or forwarded to a journalist. If the answer is no, it is not a recovery tactic. It is a future case against you.
Facing this in your own portfolio?
We will give you an honest read on what is recoverable before you commit to anything.
Request a briefing