ODPC registration and fees for accounting firms
How a Kenyan accounting firm registers with the Data Commissioner on Form DPR1, the fee bands by size, renewal, and the offence for lapsing.
By Achekam · · 5 min read · For Accountants & audit firms in Kenya
An accounting firm handles more personal data than most of its partners would guess. Payroll files for clients' employees, ID copies for company secretarial work, bank statements full of names and M-PESA numbers, the firm's own staff records. Kenya's data protection regime treats that as processing, and the registration regulations decide whether the firm must register with the Office of the Data Protection Commissioner, and what it pays.
This article covers the practical side: how registration works, which fee band a firm falls into, what happens at renewal, and where the firm's own systems fit. Whether a particular firm must register at all is a prior question, discussed in who must register with the ODPC.
Controller, processor, or both
Before filling in any form, settle the firm's role. A firm is a data controller for its own staff records, its marketing lists and its client relationship data, because it decides why and how that data is used. When it runs payroll for a client or processes a client's records on the client's instructions, it may be acting as a processor for that client.
Most practices end up as both. The registration regulations cover controllers and processors alike, and the fee schedule applies to "controllers or processors", so the classification shapes the application rather than the fee band.
The small-entity exemption, and its limits
The registration regulations contain an exemption for small entities. It is not available to everyone. The Third Schedule says it does not apply to controllers or processors that process personal data for purposes such as education, health care, hospitality, property management, financial services, telecommunications, direct marketing, transport including ride hailing, gambling, CCTV security, genetic data or canvassing political support.
A firm should look at that list against its own activities and its clients' sectors. A practice whose work includes processing for, say, health-care or property-management clients should think carefully before assuming the exemption covers it, and take advice if the answer is unclear.
Applying: Form DPR1
Registration is made on Form DPR1, submitted with the fee the Second Schedule sets for the applicant's size. The regulations also provide for renewal applications once the certificate expires.
The full text of the registration regulations, covering who must register, the small-entity exemption and the fees and renewal, is available on Kenya Law's page for the registration regulations.
Fee bands by size
The Second Schedule sets the fees by size, measured by both employees and turnover. At the time of writing, it lists:
| Size | Employees | Annual turnover | Registration fee | Renewal fee |
|---|---|---|---|---|
| Micro and small | 1 to 50 | Up to Kshs 5 Million | Kshs 4,000 | Kshs 2,000 every 2 years |
| Medium | 51 to 99 | Kshs 5,000,001 to Kshs 50,000,000 | Kshs 16,000 | Kshs 9,000 |
| Large | More than 99 | Above Kshs 50 Million | Kshs 40,000 | Kshs 25,000 |
Public entities and charities or religious entities pay the same Kshs 4,000 and Kshs 2,000 as the micro and small band.
A firm whose staff numbers put it in one band and whose turnover puts it in another should read the schedule's wording closely before choosing, and keep a note of how it decided. Fees can change, so confirm them on the official text before applying.
Renewal, and the offence for lapsing
The registration certificate does not last for ever. For micro and small entities, the schedule shows the renewal fee falling due every 2 years. Whatever the band, the regulations make it an offence to continue processing personal data after the certificate has expired without renewing it, with the offence provision citing section 73 of the Data Protection Act.
For an accounting firm, "continuing to process" is not optional. Payroll runs every month and client files are opened every day. A lapsed certificate therefore exposes the firm almost at once, which is why the renewal date belongs on the same calendar as practising licences and tax deadlines.
The wider framework
Registration is one part of a larger set of rules. The ODPC lists Kenya's data protection framework as the Data Protection Act, 2019 together with the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 and the Data Protection (Complaints Handling and Enforcement) Regulations, 2021. The same page also lists the Data Protection (Civil Registration) Regulations, 2020 and the Malabo Convention.
Two related obligations come up often for firms: telling a controller quickly when something goes wrong, covered in the processor's breach notice, and moving personal data across borders, covered in personal data outside Kenya.
What Achekam can show about access
A registration certificate says the firm processes personal data. A good data protection posture also means being able to say who in the firm can reach which data, and what they did with it. Two Achekam settings help with that inside the practice.
Roles and permissions. A firm can allow or deny what each role may do, check why a particular member may or may not act, and grant named time and collaboration permissions per role or per person. Tightening who can open payroll and identity documents is a sensible first use.
A log of changes. Record Governance keeps a log of changes to governed records, showing who did what, when and with what result, which can be filtered and checked for an unbroken chain. Viewing it needs the AUDIT_LOG_VIEW permission, and it covers records under record governance, not every screen.
Neither feature is a registration tool. They support the accountability the regime expects once the firm is registered.
An annual data protection diary
| When | Task |
|---|---|
| Start of the year | Confirm headcount and turnover band; check the fee schedule |
| Each quarter | Review who holds roles that open personal data in Achekam |
| Before expiry | Prepare and submit the renewal with the fee |
| After renewal | File the new certificate where partners can find it |
| Any time a breach is suspected | Follow the firm's breach procedure without delay |
Where to start
Find the firm's current certificate, if there is one, and note its expiry date. If there is none, work out the band from this year's headcount and turnover and prepare Form DPR1 before the question comes from a client's procurement team.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
