Privacy and Mobile Lending in Kenya: What Personal Data Do Lenders Access?

Applying for a mobile loan in Kenya is quick — sometimes less than five minutes from download to disbursement. But in those five minutes, you hand over a remarkable amount of personal information. Your national ID number, phone number, M-Pesa transaction history, contacts, device details, and sometimes much more pass through the hands of a private company whose data practices you have probably never scrutinised.

This is not inherently problematic. Credit assessment requires data. KYC verification requires identity information. Fraud prevention requires device signals. But the distinction between data that is necessary for lending and data that is harvested for commercial purposes — or worse, sold to third parties — is critical. And Kenyan law now gives you real tools to understand and enforce that distinction.

The Data a Legitimate Lender Needs — And Why

A licensed digital credit provider in Kenya needs specific categories of data to perform its core functions. Understanding the legitimate purpose for each category helps you identify when a lender is asking for more than they need.

Identity Verification (KYC)

All CBK-licensed lenders are required to verify borrower identity under Kenya's Anti-Money Laundering (AML) requirements. This means:

• National ID number or passport number
• Full legal name
• Date of birth
• A selfie or photo for biometric matching (for larger loan amounts)
• KRA PIN for higher-value loans

This is standard KYC practice and is legally required. A lender that does not collect this information for identity verification is either operating below the legal threshold or cutting corners on AML compliance.

Credit Assessment Data

To assess whether to extend credit and at what limit, lenders need information about your financial behaviour. In Kenya, this typically involves:

• Your M-Pesa transaction history (income patterns, spending, existing loan repayments)
• Your CRB credit history — accessed through an inquiry to one of the licensed CRBs (Metropol, TransUnion, Creditinfo)
• Loan repayment history with the same lender (for repeat borrowers)

Access to your M-Pesa statement is typically done either through Safaricom's API (with your explicit consent) or by requesting you upload a statement manually. Your consent is required, and the purpose — credit assessment — must be stated.

Disbursement and Repayment

For M-Pesa disbursement, the lender needs your M-Pesa-registered phone number. That is all. They do not need your M-Pesa PIN — ever. Any lender who asks for your PIN is either scamming you or engaging in a practice that violates Safaricom's terms of service and Kenyan financial regulations.

Where Data Collection Goes Beyond What Is Necessary

The problems start when app permissions extend beyond what is required for the above functions. Before the CBK's licensing regime and the stricter enforcement of the Data Protection Act 2019, many Kenyan loan apps harvested data far beyond what was needed for lending.

Contact List Access

Reading your phone contacts serves no legitimate credit assessment purpose. Contacts were harvested for one primary reason: to use them as leverage in debt collection — contacting family, friends, and employers to shame borrowers into repayment. This practice is now prohibited under CBK conduct rules and constitutes processing data beyond the stated purpose under the Data Protection Act 2019.

If a loan app requests access to your contacts and you cannot identify a legitimate stated reason in their privacy policy, deny the permission.

Continuous Location Tracking

Some loan apps requested "always on" location access. While location data at the time of application might have a marginal anti-fraud use, continuous location tracking of all borrowers serves no credit assessment purpose. This is data harvesting for commercial profiling — and it requires your explicit, informed consent under the Data Protection Act.

Call Logs and SMS

Access to SMS messages can serve a legitimate purpose — verifying M-Pesa transaction messages to assess financial behaviour. But the scope matters. An app that reads all your SMS messages rather than filtering for financial transactions is collecting far more than is necessary. Some apps were found to read SMS messages including private communications, raising serious privacy concerns.

Your Rights Under the Data Protection Act 2019

Kenya's Data Protection Act 2019 came into force in November 2019 and is enforced by the Office of the Data Protection Commissioner (ODPC). For mobile loan borrowers, it establishes several rights that directly apply to how lenders handle your data:

Right to Consent

Processing your personal data requires your free, specific, informed, and unambiguous consent. Pre-ticking consent boxes, hiding consent clauses in long terms, or making consent a condition of using an app (without alternative) does not meet this standard in most circumstances.

Right to Know

You have the right to be told what data is collected, why it is collected, who it is shared with, and how long it is retained. This must be disclosed in a clear privacy policy before you apply for a loan.

Data Minimisation

Lenders may only collect data that is "adequate, relevant and limited to what is necessary" for the stated purpose. A lender who collects your contact list, call logs, gallery, and continuous location data to provide a 30-day loan of KES 5,000 cannot justify this data collection under the minimisation principle.

Right to Access

You can request a copy of all personal data a lender holds about you. The request must be responded to within a reasonable time. If a lender refuses or ignores your request, you can escalate to the ODPC.

Right to Erasure

Under certain conditions — including where the data was collected unlawfully, or where you withdraw consent and there is no other legal basis for retention — you can request that a lender delete your personal data.

What Happens to Your Data After You Repay?

One of the least understood aspects of digital lending data is what happens after your loan is closed. Legitimate practices include:

• Retaining your credit history for the lender's own risk modelling (disclosed in their privacy policy)
• Reporting your repayment history to CRBs (this is positive — it builds your credit score)
• Deleting operational data no longer needed for the loan relationship

Problematic practices include:

• Retaining your data indefinitely without a stated retention period
• Sharing your data with third-party marketers after the loan relationship ends
• Selling aggregated or de-identified borrower data to data brokers without disclosure

A lender's privacy policy should specify the retention period for each category of data. If it does not — or if the retention period is stated as "indefinitely" without justification — this is a gap in their compliance with the Data Protection Act.

How to Evaluate a Lender's Privacy Practices Before You Apply

Before downloading a loan app or applying with a digital lender, take five minutes to review their privacy practices:

1. Read the privacy policy — specifically the sections on what data is collected, why, who it is shared with, and how long it is retained
2. Check app permissions before installing — the Play Store shows requested permissions before download
3. Search the lender's name alongside "data privacy Kenya" — community reports of privacy violations tend to surface quickly online
4. Verify they are registered with the ODPC — data controllers processing personal data in Kenya are required to register with the ODPC at www.odpc.go.ke
5. Check whether their privacy policy references the Data Protection Act 2019 — a policy that does not acknowledge Kenyan law is either outdated or not designed for Kenyan borrowers

Choosing a Lender That Respects Your Data

Privacy and lending are not in conflict. A well-run digital lender collects what they need, protects it properly, uses it only for stated purposes, and gives you meaningful control over it. The best lenders in Kenya's market have built their privacy practices around the Data Protection Act 2019 and the CBK's requirements — not as a compliance exercise, but because borrower trust is a core business asset.

When you borrow through a platform like SwiftCash, you are engaging with a lender that operates within Kenya's regulatory framework — including data protection requirements. The alternative, borrowing from an unregulated or non-compliant lender, means handing your personal data to an entity that may use it in ways you have not consented to and cannot control.

Your financial data is some of the most sensitive information you possess. It reveals your income, your spending patterns, your financial pressures, and your relationships. Treat decisions about who you share it with as seriously as you treat decisions about who you lend money to.