A business can collect personal data long before it thinks of itself as a data business. Recruitment files, customer telephone numbers, identification documents, transaction histories and website enquiries all deserve attention.
The practical starting point for ODPC registration is a short assessment: what information do you handle, why do you handle it, and whose decisions govern its use? Answering those questions first makes the application more accurate and helps identify weaknesses that a certificate alone will not resolve.
1. Decide whether you are a controller, a processor, or both
A controller decides the objectives and essential arrangements for using personal information. A processor handles it for a controller. The classification depends on the activity, so one organisation can perform both roles. These concepts come from section 2 of the Data Protection Act, 2019.
For example, a payroll service may process a client’s employee records under instructions while deciding independently how to use records about its own staff. Review each relationship before selecting a category. Calling every technology supplier a processor, or treating the whole business as one role without examining its services, can produce an incomplete application.
Where both roles apply and registration is required, ODPC requires two applications and separate fees. ODPC registration FAQs.
2. Check the exemption and the activities that override it
The small-entity exemption generally requires both annual turnover or revenue below KES 5 million and fewer than ten employees. A business at either threshold does not satisfy that exemption. Specified activities remain subject to registration regardless of size. Registration Regulations, regulation 13.
The Third Schedule covers political campaigning, preventing or prosecuting crime including security CCTV, gambling, educational institutions, patient care and health administration, hospitality except tour guides, managing or selling property, financial services, telecommunications, principally direct-marketing businesses, transport and genetic-data processing. Third Schedule.
The useful question is therefore broader than “Are we a small business?” A small payments operator, clinic or property manager should examine the activity rule before relying on its headcount. Write down the basis for your conclusion and revisit it when the business changes.
3. Prepare the information before opening the application
Prepare the entity’s establishment documents, official contacts, processing purposes, categories of people and information involved, sensitive-data activities, overseas transfers and security safeguards. ODPC asks for descriptions of information types; it does not require you to reproduce your entire customer database in the application. Include a DPO’s details where applicable or the appropriate contact person. ODPC registration guidance.
A useful working file has five tabs: customers, employees, suppliers, systems and transfers. For each, record the business purpose, person responsible and supporting document. Ask the operational team to check it. A polished policy is of limited help if the application omits an everyday workflow, such as customer support using an overseas system.
Gather evidence of controls already operating. If staff access is restricted, identify how permissions are approved and removed. If retention periods exist, check whether someone actually applies them. This turns registration preparation into a practical review rather than a copying exercise.
4. Apply through the official portal and confirm the fee
Use the registration link on the ODPC website, which directs applicants to its data portal. Complete the relevant role application, check the organisation and processing details, submit the supporting material and follow the official invoice and payment instructions.
ODPC publishes these fees per registration role:
| Published category | Initial registration | Renewal |
|---|---|---|
| Micro and small | KES 4,000 | KES 2,000 |
| Medium | KES 16,000 | KES 9,000 |
| Large | KES 40,000 | KES 25,000 |
| Public entities | KES 4,000 | KES 2,000 |
| Charities and religious entities | KES 4,000 | KES 2,000 |
The fee tier uses employee numbers and turnover or revenue. ODPC explains that both relevant criteria must be met to move into the next tier. Confirm classification against the detailed schedule, especially where headcount and revenue fall in different bands. Professional fees and any applicable transaction charges are separate. ODPC fee guidance and FAQs.
5. Track review and maintain the certificate
Regulation 8 provides for a certificate within 14 days once the Commissioner is satisfied that registration requirements are fulfilled. This should not be presented as a guaranteed end-to-end turnaround for an incomplete application. Keep a record of queries, responses and payment. Registration Regulations.
Certificates run for 24 months. ODPC’s FAQs direct applicants to seek renewal at least 30 days before expiry. Set internal reminders earlier, so the responsible person can check changes and arrange payment without rushing. ODPC renewal guidance.
6. Keep the underlying privacy programme working
Registration sits alongside duties concerning lawful processing, transparency, individual rights, security and international transfers. These obligations require attention throughout operations. Data Protection Act, Parts IV–VI.
As a practical operating checklist, assign responsibility for privacy enquiries, maintain usable notices, review supplier contracts and train staff on escalation. Test a sample customer journey: what does the person see, what information is collected, who can access it and how would a correction request reach the right team?
Changes to registered particulars must be notified within 14 days. Include a privacy review in product launches, supplier changes and restructurings. Registration Regulations, regulation 15.
Frequently asked questions
Does a new business need a customer database before considering registration?
Start with the planned activities and information flows. Hiring staff, taking enquiries and onboarding suppliers can all create processing questions before the first sale.
Can my technology provider handle the whole application?
It can provide system information, but management should check that the submission accurately describes the business and the decisions it makes.
What should I prepare for a registration assessment?
A short business description, approximate headcount and revenue, main data uses, supplier list and any existing privacy documents make the first review more productive.
Need help assessing your registration position? Email info@snnyagaadvocates.co.ke with the subject “ODPC Registration Assessment” and a short description of your business. S.N. Nyaga & Company Advocates can help assess the applicable roles, prepare the application and address related privacy documentation.
General information reviewed on the date above; the appropriate approach depends on the business and its activities.
Continue your preparation
Explore all six Kenya business guides, our related legal service, and the Legal Toolkit. For continuing updates, read the Commercial and Regulatory Briefing.