ODPC Registration in Kenya: Who Must Register, Fees & Steps

If your business keeps a customer list, runs a contact form, records staff details for payroll or has a CCTV camera at the gate, you are handling personal data. Under Kenya’s Data Protection Act, 2019, many organisations that do this must register with the Office of the Data Protection Commissioner (ODPC) as a data controller, a data processor, or both. This guide explains who has to register, what the ODPC asks for, what it costs and what to do once the certificate arrives.

This is a practical guide, not legal advice. Fees and portal screens can change, so confirm the current details on the ODPC website (odpc.go.ke) before you pay.

Controller or processor: which one are you?

The Act separates two roles, and the difference decides what you register as.

Data controller: you decide why personal data is collected and how it is used. A school deciding what to record about learners, a clinic keeping patient files and a shop running a loyalty list are all controllers.
Data processor: you handle personal data on someone else’s behalf, under a contract, and you follow their instructions. A payroll bureau, a cloud host storing a client’s customer records or a call centre working through a client’s list are processors. Your own employees are not processors.

Some organisations are both. A marketing agency is a controller for its own staff and clients’ contact details, and a processor when it runs a campaign on a client’s customer list. The ODPC treats these as two separate registrations with two separate fees.

Do you have to register?

Start from the assumption that you do. Registration is required under section 18 of the Act and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. There is one exemption, and it is narrower than many people think. You are exempt from mandatory registration only if both of these are true:

your annual turnover or revenue is below KES 5 million, and
you have fewer than ten employees.

Meet only one of the two and you must register. And even a business that meets both loses the exemption if it processes personal data in one of the sectors listed in the regulations. According to the ODPC, these include:

education (schools, colleges, training centres)
health administration and patient care (clinics, pharmacies, labs)
hospitality (hotels, lodges, restaurants that take bookings)
property management, including selling land
financial services, insurance, credit bureaus, debt collection and retirement benefits administration (SACCOs and microfinance fall here)
betting and gaming
transport services, including ride-hailing apps
telecoms and internet access providers
businesses that are wholly or mainly in direct marketing
crime prevention, including private security firms and organisations running security CCTV
faith-based and religious institutions, public bodies, political canvassing and anyone processing genetic data

So a two-person clinic in Machakos and a small boarding school in Nyeri both have to register, whatever their turnover. Note too that the exemption only removes the duty to register. Exempt organisations must still follow the rest of the Act: collect only what they need, keep it secure and respect people’s rights over their data.

What to prepare before you open the portal

Registration is done online through the ODPC’s registration portal, linked from odpc.go.ke. The form is easier if you gather this first:

Establishment documents: your certificate of incorporation or business registration, or the equivalent for a society, school or church.
Contact particulars for the organisation and the person responsible for data protection.
Proof of turnover or revenue for the previous year, such as KRA returns or audited accounts. This decides your fee tier.
Your processing purposes: payroll, invoicing, KYC, admissions, marketing, CCTV and so on.
Categories of data you hold, such as names, ID numbers, phone numbers, health information or photos.
Categories of people it is about: employees, customers, learners, parents, patients, suppliers.
Who you share it with: for example KRA, SHA, insurers, a payroll provider or your web host.
Your safeguards: access control, passwords and two-factor login, backups, a visitors’ book, a privacy policy, an information security policy.

The last three items take the longest, because most businesses have never written them down. Walk through the business one department at a time and list every place personal data comes in: website forms, WhatsApp chats, M-Pesa statements, job applications, the reception book. That list becomes your answer to half the form, and it is useful long after registration.

Fees and payment

The ODPC’s published registration fees (paid once, per registration) are:

Micro and small (up to 50 employees and turnover up to KES 5 million): KES 4,000
Medium (51 to 99 employees and turnover between KES 5 million and KES 50 million): KES 16,000
Large (more than 99 employees and turnover above KES 50 million): KES 40,000
Public bodies, charities and religious institutions: KES 4,000

You only move up a tier if you meet both conditions. A business with high turnover but ten staff still registers as micro and small. Payment can be made by M-Pesa, card, bank transfer or cheque. The ODPC says mobile money and card payments carry a small transaction fee. Your application is reviewed once payment is confirmed.

What happens after you apply

If the application is approved, the ODPC says a certificate is issued within 14 days and your details go into the public register.
If it is rejected, you are told why within 21 days. You can fix the issue and apply again, but that is a fresh application with a fresh fee.
The certificate is valid for 24 months. Apply for renewal at least 30 days before it expires. Renewal fees are lower than first-time fees.
If any registered details change, such as your address, what you process or who you share it with, notify the ODPC in writing within 14 days.

Registration is the start, not the finish

The certificate shows you are known to the regulator. It does not show that you handle data well. The duties that matter day to day are:

Tell people what you collect and why. A clear privacy notice on your website and forms, in plain English (and Kiswahili if your customers use it).
Have a lawful reason for each use, and get proper consent for things like marketing messages.
Collect less. If a contact form does not need an ID number, remove the field.
Respond to requests from people who want to see, correct or delete their data.
Report breaches. Where a breach poses a real risk to people, the Act requires you to notify the Data Commissioner without delay, and within 72 hours of becoming aware of it.
Assess high-risk processing before you start it, for example new biometric attendance systems or large-scale tracking.

Where your website fits in

For most small organisations the website is the busiest point of data collection, and the most exposed. Contact and booking forms, newsletter sign-ups, live chat and analytics all gather personal data, and an outdated plugin or a leaked admin password can expose all of it at once. Before you register, check where form entries are stored, who can log in, whether the site runs on HTTPS, and whether you have a backup you have actually tested. Our website security and managed hosting service covers those basics: updates, backups, SSL and monitoring.

If you are in one of the sectors that must register regardless of size, the systems you run matter even more. Software that handles patient records, member savings or learner files should restrict who sees what and keep an audit trail. That is how we build the tools in our clinic and pharmacy systems, our SACCO and chama software and Anademy ERP for schools.

A short checklist

Decide whether you are a controller, a processor or both.
Check the exemption honestly: both conditions, and not in a listed sector.
Map where personal data enters and leaves the business.
Gather documents and proof of turnover.
Apply and pay on the ODPC portal.
Diary the renewal date, 30 days before the 24 months run out.
Fix the obvious gaps: privacy notice, form fields, logins, backups.

Questions about the registration itself go to the ODPC, which publishes its contacts and a full guidance note on its website. If you want help with the technical side, such as securing the website, tightening forms or setting up backups, get in touch.

Related guides

Want help with this?

Tell us about your business in a few lines. We reply within one working day.

Ananke Digital may reply to me about this. Privacy

Prefer WhatsApp? +254 790 939 404 · We reply within one working day.

How to register with the ODPC as a data controller in Kenya