68. Article 260 of the Constitution denes a person “person” includes a company, association or other body of persons whether incorporated or unincorporated. 69. From the Act it is evident that companies, limited liability partnerships, and other legal entities are not considered data subjects. As such, legal entities cannot bring complaints to the Commissioner. 70. According to section 3 of the Act, the object and purpose of this Act is— 71. (a) To regulate the processing of personal data; (b) To ensure that the processing of personal data of a data subject is guided by the principles set out in section 25; (c) To protect the privacy of individuals; (d) To establish the legal and institutional mechanism to protect personal data; and (e) To provide data subjects with rights and remedies to protect their personal data from processing that is not in accordance with this Act. The applicants are partners in the 3rd applicants law rm. i am satised that the applicants had the capacity to lodge a complaint with the ODPC under the Data Protection Act. Disposition: 72. The decision of the Data Protection Commission dated January 6, 2023 was rendered outside time without jurisdiction and therefore a nullity. The moment the 90 days ended, the respondents’ jurisdiction lapsed. This court cannot countenance nor out mandatory timelines that have been expressly provided for in law. 73. No matter how logical, sound, reasonable or persuasive the respondents’ nding is, the same is standing on quick sand. No amount of policy, wisdom or practicality can invest a decision made without jurisdiction with any legal authority nor generate any enforceable outcomes. It remains a still birth at law. 74. This court’s power and authority ows from the Constitution and the Fair Administrative Action Act. Section 11(1)(h) of the Fair Administrative Action Act provides that in proceedings for judicial review under section 8, the court may grant any order that is just and equitable, including an order remitting the matter for reconsideration by the administrator. 75. An order of mandamus compelling the respondent to readmit for fresh investigations the complaint dated July 20, 2022 by the applicants within 30 days from the date of readmission will promote the right to access to justice and uphold the rule of law as guaranteed under article 10 of the Constitution commends itself. 76. In prayer D of the application, the applicants sought for a declaration that the decision by the respondent made on January 6, 2023, violated the applicants right to a fair hearing and the principles of Fair Administrative Action as provided for under articles 47 and 50 of the Constitution of Kenya, 2010 by failing to consider the applicants evidence that had been submitted. 77. This relief can only be conclusively determined after an in-depth analysis of the merits of the case. This court will not delve into that arena since doing so would amount to the usurpation of the role of the Oce of the Data Protection Commission and the Court of Appeal. kenyalaw.org/caselaw/cases/view/258092/ 15