Data Protection in Kenya

Registration in Kenya

Section 18 of the Act

Data processors and data controllers are required to be registered with the DPC. The DPC, however, has discretion to prescribe the thresholds for mandatory registration based on:

  • the nature of industry;
  • the volumes of data processed; and
  • whether sensitive personal data is being processed.

The Data Protection (Registration of Data Controllers & Data Processors) Regulations, 2021, provides for the registration of data controllers and data processors with the DPC. The threshold for mandatory registration is also set out under these regulations. The DPC also launched a portal where applications for registration are submitted in the prescribed form and upon payment of a prescribed fee. Where the DPC is satisfied that the applicant has fulfilled the requirements for registration, a certificate of registration is issued within 14 days and entry of the applicant’s details is made in the register of data controllers and data processors.

The certificate of registration issued is valid for 24 months from the date of issuance.

A data controller or data processor with an annual turnover or revenue of below Kenya Shillings Five Million (approx. USD 40,000) and has less than 10 employees is exempt from mandatory registration.

Data controllers and data processors who process data for the following purposes regardless of their annual turnover or revenue or number of employees have to be registered under the Regulations:

  • canvassing political support among the electorate;
  • crime prevention and prosecution of offenders (including operating security CCTV systems);
  • gambling;
  • operating an educational institution;
  • health administration and provision of patient care;
  • hospitality industry firms, excluding tour guides;
  • property management including the selling of land;
  • provision of financial services;
  • telecommunications network or service providers;
  • businesses that are wholly or mainly in direct marketing; and
  • transport services firms (including online passenger hailing applications); and businesses that process genetic data.

Continue reading

  • no results

Previous topic
Back to top