Kenya’s Employment and Labour Relations Court has upheld Safaricom’s decision to dismiss former Head of Regional Expansion Brian Njoroge Wamatu over allegations involving the unauthorised access and sharing of confidential subscriber and company information, in a ruling that underscores the growing legal risks surrounding data access in East Africa’s digital economy.
Justice B. O. M. Manani dismissed Wamatu’s claims of unfair termination, defamation and loss of employee share-plan benefits, finding that Safaricom had a valid reason for terminating his employment and had followed a fair disciplinary process.
The ruling, delivered on August 6, 2026, brings to a close a seven-year employment dispute stemming from a 2019 investigation into allegations that Safaricom employees had unlawfully obtained, compiled and shared confidential subscriber information.
At the centre of the case was the evidence Safaricom relied on to dismiss Wamatu.
The company’s internal investigation allegedly linked him to the unauthorised acquisition of subscriber information, internal security material and details concerning senior managers’ remuneration. Safaricom subsequently reported suspected criminal conduct to investigators and initiated disciplinary proceedings against Wamatu.
The court found that the investigation report provided Safaricom with sufficient material to form a genuine belief that Wamatu had committed serious misconduct.
Importantly, the court distinguished the standard applicable in an employment disciplinary matter from the higher standard required in a criminal prosecution.
Safaricom was not required, for purposes of terminating Wamatu’s employment, to prove the alleged misconduct beyond reasonable doubt. Rather, the company needed a reasonable and evidence-backed basis for its decision and was required to follow a fair disciplinary process.
The court found that it had done so.
A dispute dating back to 2019
Wamatu joined Safaricom in November 2008 as a VAS Product Manager and rose through the company’s ranks to become Head of Regional Expansion. His salary had increased from about Sh170,000 at the beginning of his career to approximately Sh1.2 million a month by the time his employment ended.
The dispute erupted in June 2019 when Wamatu was arrested following investigations into allegations involving the illegal access and transfer of Safaricom subscriber information.
Wamatu told the court that he was accosted while having dinner at a Nairobi establishment on June 7, 2019, before being taken to the Directorate of Criminal Investigations for questioning. He argued that Safaricom had effectively made him a scapegoat and that the disciplinary proceedings against him were predetermined.
Safaricom rejected the allegations, maintaining that it had merely reported suspected criminal conduct after an internal investigation raised concerns about the handling of confidential information.
The company subsequently dismissed Wamatu in June 2019.
Wamatu challenged the dismissal, arguing, among other things, that he had not received a fair hearing because he was attending a DCI meeting on the day scheduled for his disciplinary hearing.
The court rejected that argument, finding that the DCI meeting had ended around midday and that Wamatu still had sufficient time to attend the disciplinary hearing scheduled for 4 p.m.
The court also found that Safaricom had issued a show-cause letter, considered Wamatu’s written response, provided relevant investigation material, allowed him to participate in the disciplinary process and gave him an opportunity to appeal.
His defamation claim was also dismissed after the court found that it had been filed outside the applicable one-year limitation period.
Why the ruling matters beyond Safaricom
The significance of the judgment extends beyond the employment relationship between one executive and one telecommunications company.
Telecom operators have become some of the largest repositories of personal and commercially valuable information in East Africa. Mobile subscribers generate extensive records through voice calls, messaging, mobile-money transactions, customer-service interactions and other digital services.
Kenya’s telecommunications market illustrates the scale of the data environment. The Communications Authority reported 84.1 million active mobile subscriptions and 53.4 million active mobile-money subscriptions in the third quarter of the 2025/26 financial year.
That makes control over employee access increasingly important.
The Wamatu case demonstrates that having legitimate access to information because of one’s job does not necessarily give an employee unrestricted authority to obtain, compile, transfer or disclose that information.
For companies, it also highlights the importance of maintaining reliable internal controls and investigation records that can demonstrate how a suspected breach was identified and how disciplinary decisions were reached.
The wider data-protection question
The ruling comes against the backdrop of increasingly aggressive scrutiny of personal-data protection in Kenya.
In a separate case earlier this year, Kenya’s High Court found Safaricom liable over a major subscriber-data breach involving allegations that personal information had been extracted and disseminated without authorisation. The court awarded compensation to 11 subscribers, reinforcing the principle that organisations entrusted with personal data can face legal responsibility when that information is inadequately protected.
Taken together, the cases point to a more complicated legal environment for East Africa’s digital businesses.
Companies must increasingly manage two related but distinct risks: the risk created by employees or other insiders misusing information, and the organisation’s own responsibility to protect the information entrusted to it.
That distinction will become increasingly important as telecom companies, banks, fintech firms, insurers and technology platforms collect and process ever-larger volumes of personal information.
A warning for East Africa’s digital economy
The case also offers a broader lesson for businesses operating across East Africa.
Data is rapidly becoming a core economic asset. Customer information can support product development, fraud detection, financial services, marketing and business intelligence. But the same information can create substantial legal and reputational exposure if it is accessed or used outside authorised purposes.
For employers, that means data protection can no longer be treated solely as an information-technology function.
Access controls, employee responsibilities, audit trails, internal investigations and disciplinary procedures are becoming part of corporate risk management.
For employees, the principle is equally clear: access is not ownership.
An employee may legitimately encounter sensitive information in the course of performing a job, but that access does not automatically authorise the employee to reproduce, transfer or disclose it for unrelated purposes.
The Wamatu judgment therefore arrives at a significant moment for East Africa’s digital economy.
As the region expands mobile money, digital banking, artificial intelligence, electronic commerce and data-driven services, the volume and value of information held by private companies will continue to grow.
The legal question will increasingly be not simply who owns the data, but who is authorised to access it, for what purpose, under whose oversight and what happens when those boundaries are crossed.
The Kenyan court’s decision provides a clear answer on one part of that equation: where an employer has credible evidence of serious data-related misconduct and follows a fair disciplinary process, it does not necessarily have to wait for a criminal conviction before taking employment action.
For East Africa’s increasingly data-dependent businesses, that is a significant precedent—and a warning that the people given access to valuable information can become one of the most important components of an organisation’s data-security architecture.
