Who has to register
Section 18 of the Kenya Data Protection Act, 2019 says no person may act as a data controller or data processor unless registered with the Data Commissioner. The detail sits in the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
Under those Regulations, an organisation with an annual turnover or revenue below KES 5 million and fewer than ten employees is exempt from mandatory registration. The exemption does not apply to organisations whose processing falls in a sector listed in the Regulations' schedule. Those sectors include:
- Health care and the provision of health services
- Education
- Financial services, insurance and credit reference
- Telecommunications and internet service providers
- Transport and the hospitality industry
- Real estate and property management
- Canvassing political support and crime prevention
- Processing genetic data
If you are unsure whether a schedule entry covers you, register: operating unregistered when you should not is an offence, while voluntary registration costs only the fee.
What the application asks for
Applications are made online through the ODPC's registration portal. Have these ready before you start, because the form asks for them in one sitting:
- The organisation's legal details, KRA PIN and contact person
- A description of the personal data you process and the purposes you process it for
- The categories of data subjects (customers, employees, patients, students) and of personal data
- Who you share data with, and any country outside Kenya you transfer it to
- A general description of your security safeguards
- Your annual turnover and staff numbers, which set your fee tier
Most of this is your record of processing activities. Organisations that keep a current ROPA finish registration in an afternoon; those that do not usually stall on the purposes and recipients questions.
Fees and renewal
The Regulations set fees by size: KES 4,000 for micro and small organisations, KES 16,000 for medium organisations and KES 40,000 for large organisations. Check the ODPC's current fee schedule before paying, as fees are set by regulation and can change.
A registration certificate does not last indefinitely. Note its expiry date when it is issued and diarise the renewal well ahead, along with any change in your processing that the ODPC should be told about.
After you are registered
Registration is the start of compliance, not the end. The Act's other duties apply from day one: the data protection principles in section 25, the rights of data subjects in section 26, breach notification within 72 hours, and a data protection impact assessment before high-risk processing.
Keep the certificate with the evidence an ODPC inspector would ask for. In hlola, the registration is a control on your Kenya readiness card, with its renewal date tracked as a task.
Common questions
Is ODPC registration mandatory for small businesses?
Not always. Organisations with annual turnover below KES 5 million and fewer than ten employees are exempt, unless their processing falls in a sector the Registration Regulations make mandatory, such as health, education or financial services.
How much does ODPC registration cost?
The Regulations set KES 4,000 for micro and small organisations, KES 16,000 for medium and KES 40,000 for large organisations. Confirm the current schedule with the ODPC before paying.
What happens if we process data without registering?
Acting as a data controller or processor without registration when you are required to register breaches section 18 of the Act and exposes the organisation to enforcement by the Data Commissioner.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.