By Our Law Team on April 22, 2025
Under the Data Protection Act, 2019, every data controller or data processor operating in Kenya must register with the Office of the Data Protection Commissioner (ODPC), unless exempt. In practice this covers employers, banks, hospitals, schools, e-commerce businesses, digital lenders, real estate agents and most organisations that hold customer or employee personal data.
Failure to register is an offence. Penalties include fines of up to KES 5 million or 1% of annual turnover for data controllers, and up to KES 20 million or 2% of annual turnover for data processors. Regulators have begun targeted enforcement, so organisations should not wait for a complaint.
Registration is not limited to tech companies. The Data Protection (Registration of Data Controllers and Data Processors) Regulations require a controller or processor to register where it meets the conditions set out in those Regulations. The triggers most commonly relied on are:
In practice, an employer with a substantial workforce, a school, a clinic, an estate agency with a client database or an online shop that collects customer details will usually satisfy at least one of these conditions. If your organisation processes personal data of any kind, the safe course is to document the analysis and register rather than assume an exemption.
A data controller decides why and how personal data is processed; a data processor processes it on another organisation's instructions. Many Kenyan businesses are both: a payroll bureau is a processor for its clients but a controller of its own staff records. The label matters because the obligations differ - controllers owe the primary duties to data subjects (privacy notices, rights responses, breach reporting), while processors owe duties of security and confidentiality, may only act on documented instructions, and must assist the controller. Both must register where the conditions apply.
Registration fees are prescribed by regulation and scale with the category of the registrant, so a small professional practice pays less than a bank or a telecommunications operator. The certificate of registration is issued for the period stated on it and must be renewed - a lapsed certificate leaves the organisation processing personal data without registration, which is exactly the position enforcement notices are designed to catch. Changes to the organisation, its contact person, its data protection officer or the nature of its processing should be updated with the ODPC as they happen rather than at renewal.
The ODPC does not only react to complaints. It conducts audits and inspections, issues enforcement notices requiring an organisation to comply within a fixed period, and has publicly named entities it has penalised. Under the Data Protection Act a serious contravention can attract an administrative penalty of up to five million shillings or one per cent of annual turnover, whichever is lower, and separate offences - obstructing the Commissioner, failing to cooperate, or processing without a lawful basis - carry their own sanctions. Decisions can be appealed to the High Court, but an appeal does not suspend the compliance obligation while the regulator has an open file.
ODPC registration sits alongside sector rules. Banks and microfinance institutions answer to the Central Bank of Kenya, insurers to the Insurance Regulatory Authority, telecommunications operators to the Communications Authority, and health facilities to the health regulators and professional councils. Tax records are also protected by taxpayer confidentiality. The practical approach is to map the obligations once, keep a single processing register, and align the privacy notice and security standards to the strictest regime that applies to you.
Compliance is more than registration - you also need privacy notices, rights responses and breach procedures. Our data protection lawyers in Nairobi manage ODPC registration and full compliance. Book a consultation to get compliant.
