How to register with the ODPC: a guide for Kenyan tech companies

If your company collects or uses personal data in Kenya, you will almost certainly need to register with the Office of the Data Protection Commissioner (ODPC). Registration is the first thing the regulator checks, and the easiest gap to close.

Who needs to register?

Under the Data Protection Act, 2019 and the Registration Regulations, 2021, both data controllers (who decide why and how data is used) and data processors (who handle data on someone else's behalf) must register.

Very small businesses can be exempt based on turnover and staff numbers. But that exemption does not apply in sectors where registration is mandatory, including health, education, financial services, telecommunications and others that handle large amounts of personal data. Most tech companies, especially fintechs, healthtechs and platforms, should assume they need to register.

What to prepare

• Company details: registration documents, contact details and the person responsible for data protection.
• What data you process: the categories of personal data and of people (customers, staff, users).
• Why you process it: the purposes, such as providing your service, payments or marketing.
• Where it goes: who you share data with, and whether it leaves Kenya (for example, to cloud providers).
• How you protect it: a description of your security measures.

If you can't answer these questions yet, start with a data mapping exercise. It is useful far beyond registration.

The registration process

1. Map your data and confirm whether you register as a controller, a processor or both.
2. Complete the online application on the ODPC portal.
3. Pay the registration fee for your category.
4. Receive your registration certificate, and diarise its renewal date.

Registration is the start, not the finish

A certificate does not make you compliant. The ODPC also expects privacy notices, a lawful basis for processing, data subject rights procedures, DPIAs for high-risk processing, breach response plans and appropriate security. Enforcement actions so far have mostly been about how companies handle data, not just whether they registered.

How Solfa Tech helps

We handle registration from start to finish, then help you close the remaining gaps in your policies, processes and product. If you'd rather not hire a full-time Data Protection Officer, we can act as your outsourced DPO.

This guide is general information, not legal advice. Laws and regulator practice change, so confirm specifics for your situation.