NAIROBI, Kenya, Aug 29 – Organisations handling personal data in Kenya have been given 14 days to renew expired registration certificates or risk enforcement action by the Office of the Data Protection Commissioner (ODPC).
Data Commissioner Immaculate Kassait said all data controllers and data processors whose certificates have expired must regularise their status by September 11, 2026, close of business.
The directive is part of a renewed push by the data protection regulator to ensure organisations collecting, storing or processing personal information comply with Kenya’s data protection laws.
The ODPC, in a notice issued on Friday, reminded affected entities to apply for renewal without delay, warning that failure to comply within the 14-day window could trigger enforcement measures.
The notice applies to organisations whose names appear on the regulator’s published list of entities with expired registration certificates.
Under the Data Protection Act, 2019, organisations that fall within the mandatory registration requirements cannot act as data controllers or data processors without registration with the Data Commissioner. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 provide that registration certificates are valid for 24 months and must be renewed.
The regulations go further by making it an offence for a data controller or processor to continue processing personal data after its certificate has expired without renewal.
The latest warning therefore places organisations with lapsed certificates on notice that continued handling of personal information without regularising their status could expose them to regulatory action.
The renewal fees vary according to the size and category of the organisation.
Micro and small data controllers and processors pay Sh2,000 for renewal, while medium-sized entities pay Sh9,000. Large entities pay Sh25,000, while public entities, charities and religious organisations pay Sh2,000.
The ODPC’s regulations classify micro and small entities as those with between one and 50 employees and annual turnover of up to Sh5 million. Medium entities have between 51 and 99 employees and turnover of between Sh5 million and Sh50 million, while large entities have more than 99 employees and turnover exceeding Sh50 million.
The regulator has previously advised organisations to submit renewal applications at least 30 days before expiry of their certificates, rather than waiting until registration lapses.
The registration requirement covers a wide range of organisations that process personal information, including businesses, public institutions and non-profit organisations.
The ODPC lists sectors such as education, healthcare, hospitality, financial services, telecommunications, insurance, property management, transport, direct marketing, gaming and betting among those subject to mandatory registration regardless of certain turnover and staffing thresholds.
Public bodies, charities and religious organisations are also required to register, regardless of their revenue or turnover.
The law distinguishes between a data controller, which determines the purpose and means of processing personal data, and a data processor, which processes personal information on behalf of a controller.
Organisations that perform both functions are required to register separately for each role and pay the applicable fees for each registration.
The ODPC says registration is not merely an administrative requirement but forms part of Kenya’s wider framework for protecting the privacy rights of individuals as digital services and the collection of personal information expand.
Its mandate includes regulating the processing of personal data, protecting individuals’ privacy and overseeing compliance with the Data Protection Act.
The regulator has also been strengthening its internal systems. In July, Kassait officiated the launch of the ODPC’s ISO 9001:2015 Quality Management System, saying the move was intended to improve consistency, accountability and service delivery across functions including registration, complaint resolution, audits and enforcement.
Affected organisations can apply for renewal electronically through the ODPC’s registration portal. The regulator’s online system requires applicants to provide organisational details, information on the categories and purposes of personal data processed and details of safeguards put in place to protect the information.
With the September 11 deadline now approaching, organisations with expired certificates have been urged to act before the regulator begins enforcement against those that remain non-compliant.
