If your organisation keeps a customer list, runs a payroll or sends a newsletter, Kenyan data protection law already applies to you. One of the first questions organisations ask is whether formal registration with the Office of the Data Protection Commissioner is required before personal data may lawfully be processed.
Who must register with the ODPC?
Under the Data Protection Act 2019, organisations acting as data controllers or data processors are generally required to register with the Office of the Data Protection Commissioner. Registration applies where an organisation meets the thresholds of turnover and headcount set out in the law, while smaller organisations may qualify for exemption. Even where an exemption applies, the underlying duties , processing personal data lawfully, telling people how their data is used and keeping it secure , continue to apply in full.
How does the registration process work?
- Map the personal data your organisation holds, where it came from and who it is shared with.
- Decide whether you act as a controller, a processor or both, because the application differs.
- Prepare the description of processing purposes and categories of data that the application requires.
- Submit the application through the Office of the Data Protection Commissioner portal and pay the prescribed fee.
- Keep the registration certificate on file and update your registration as your processing changes.
The full text of the Data Protection Act 2019, together with the rules made under it, can be read on Kenya Law‘s website. Reviewing the statute before applying usually shortens the process, because the questions asked are drawn directly from it.
What happens if you do not register?
Processing without registration where it is required may attract enforcement measures, and it complicates dealings with banks, partners and overseas customers who ask for evidence of compliance. Registration is also a sensible moment to review contracts with vendors who handle personal data on your behalf, since processor obligations must be recorded in writing. Our contract lawyers regularly assist with such agreements. Organisations that want a structured view of their wider position often ask a commercial law firm to coordinate the review alongside their data protection officer or IT team. Learn about our governance advisory work if that describes your organisation.
For guidance on your specific situation, contact CS Advocates LLP , call, WhatsApp, or book a confidential consultation at our Westlands, Nairobi office.