Does your business need to register with the ODPC?
Whether a Kenyan business must register with the Data Commissioner as a controller or processor, the small-entity exemption and where it never applies.
By Achekam · · 4 min read · For Running a business businesses in Kenya
Every Kenyan business holds personal data. The payroll file has names, ID numbers and bank details. The customer list has phone numbers and addresses. A clinic has health records; a school has children's details; a letting agent has tenants' IDs and payment histories.
Kenya's Data Protection Act requires those who handle personal data to register with the Data Commissioner, but not everyone has to. The exemption for small businesses is real, yet narrower than many owners assume. This article explains the roles the law uses, the exemption and its exceptions, the registration form, and how to answer the question for your own business.
Controllers and processors
Kenya's Office of the Data Protection Commissioner (ODPC) defines a data controller as a person or entity that collects personal data and determines how it will be used, and a data processor as the entity that processes data on behalf of the data controller.
In everyday terms, almost every business is a controller of its own staff and customer data: it decides what to collect and why. A business becomes a processor when it handles someone else's personal data on their instructions, as a payroll bureau does for its clients' employees or a call centre for a client's customers. Many businesses are both.
Section 18 of the Data Protection Act, 2019, as consolidated on Kenya Law, says no person may act as a data controller or data processor unless registered with the Data Commissioner, subject to thresholds for mandatory registration that the Data Commissioner sets.
The small-entity exemption
Those thresholds are in the Data Protection (Registration of Data Controllers and Data Processors) Regulations. Regulation 13 exempts from mandatory registration a data controller or processor with an annual turnover or revenue below five million shillings and fewer than ten employees.
Both conditions must be met. A business with modest turnover but a dozen staff does not qualify; nor does a three-person business whose turnover is above the limit.
Exemption from registering is not exemption from the law. The Regulations note that exempt entities must still comply with Parts IV and VI of the Act. A small business that does not need a certificate still has duties under the Act, so read those Parts rather than treating exemption as the end of the matter. What to do if personal data is lost or exposed is covered in reporting a data breach to the ODPC.
Sectors where the exemption never applies
The Regulations' Third Schedule switches the exemption off for controllers and processors that process personal data for certain purposes, whatever their size. The list includes:
- education;
- health care;
- hospitality;
- property management;
- financial services;
- telecoms;
- direct marketing;
- transport, including ride hailing;
- gambling;
- CCTV security;
- genetic data;
- canvassing political support.
That list catches many small businesses. A two-doctor clinic, a small guest house, a letting agency managing a few blocks of flats, a microlender, a tuition centre and a shop that runs CCTV over its tills may each fall within it, despite low turnover and few staff. Read the Schedule against what your business actually does with personal data.
Form DPR1 and renewal
The Regulations require registration applications to be made on Form DPR1 with the fee set in the Schedule, and provide for renewal when a certificate expires. Continuing to process personal data after the certificate expires without renewing it is an offence. The fee is set out in the Regulations; ODPC registration fees looks at what applies.
Put the expiry date in the diary as soon as the certificate arrives, with a reminder well ahead of it. A business that lets its certificate lapse is in a worse position than one that never needed one.
If your business appoints a data protection officer, the Act requires you to publish the officer's contact details on your website and give them to the Data Commissioner.
Keeping your certificate and access controls in Achekam
Achekam's Document Centre is a folder-based store where a business uploads files, tags and searches them, and keeps earlier versions when a document is replaced. Keep the DPR1 application, the registration certificate and each renewal in one folder; when a renewed certificate arrives, upload it as a new version so the history stays together.
Your books hold personal data too: employees' details in payroll, customers' details on invoices. Achekam lets users turn on two-factor sign-in with an authenticator app, lets the workspace require it for every member, and supports single sign-on with Google or Microsoft Entra ID once it is set up. These settings help you control who can reach that data. They do not register you or decide your obligations; that remains a judgement for the business and its advisers. If a new system or process will handle personal data in a risky way, data protection impact assessments explains when one is needed.
A self-assessment checklist
- List the personal data the business holds: staff, customers, suppliers, visitors.
- Decide, for each, whether you act as controller, processor or both.
- Check whether annual turnover or revenue is below five million shillings.
- Check whether the business has fewer than ten employees.
- Compare your activities with the Third Schedule list above.
- If points 3 and 4 both apply and nothing in point 5 does, registration is not mandatory, but the Act's Parts IV and VI still apply.
- Otherwise, apply on Form DPR1, keep the certificate, and diary the renewal.
- If you have a data protection officer, publish their contact details and send them to the Data Commissioner.
The registration regulations on Kenya Law set out who must register as a data controller or processor, the exemption for small entities, and the registration fees and renewal.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
