ODPC Kenya: 14-Day Data Certificate Renewal Deadline Set

• Kenya's ODPC has given organizations handling personal data 14 days to renew expired registration certificates.
• All data controllers and processors with expired certificates must regularize their status by September 11, 2026.
• Failure to renew within the specified timeframe risks enforcement action and penalties under Kenya's Data Protection Act, 2019.
• Registration certificates are valid for 24 months, and renewal fees vary by entity size and category, ranging from Sh2,000 to Sh25,000.
• The ODPC views registration as crucial for protecting individual privacy rights, not merely an administrative formality.

The ODPC emphasizes that the registration requirement extends beyond mere administrative compliance; it forms a critical component of Kenya's overarching strategy to safeguard individuals' privacy rights.

Kenya's Office of the Data Protection Commissioner (ODPC) has issued a stern warning to organizations handling personal data, granting them a 14-day period to renew any expired registration certificates. This directive, announced on August 29, comes with a clear final deadline of September 11, 2026, by which all affected data controllers and processors must regularize their status to avoid regulatory penalties. Data Commissioner Immaculate Kassait underscored that this move is part of an intensified effort by the regulator to ensure full adherence to Kenya's data protection statutes.

Underpinning this directive are the provisions of Kenya's Data Protection Act, 2019, which mandates registration for organizations acting as data controllers or data processors. Without this essential registration, entities are legally prohibited from performing these functions. Further details are outlined in the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, which stipulate that registration certificates are valid for a period of 24 months and require mandatory renewal upon expiry.

The 2021 Regulations explicitly classify it as an offense for any data controller or processor to continue handling personal data once their certificate has expired without being renewed. This legal framework applies broadly, encompassing businesses, public institutions, and non-profit organizations that process personal information. Specific sectors, including education, healthcare, financial services, telecommunications, and direct marketing, are subject to mandatory registration irrespective of their turnover or staffing levels. Public bodies, charities, and religious organizations also fall under this compulsory registration requirement, regardless of their revenue.

The law distinguishes between a data controller, which determines the purpose and methods of data processing, and a data processor, which acts on behalf of a controller. Organizations that fulfill both roles are required to register separately for each function and incur the corresponding fees for each registration.

The cost of renewing a data protection certificate in Kenya varies based on the size and classification of the organization. Micro and small data controllers and processors are required to pay Sh2,000 for renewal. Medium-sized entities face a renewal fee of Sh9,000, while large organizations must pay Sh25,000. Public entities, charities, and religious organizations are also subject to a Sh2,000 renewal fee.

The ODPC defines micro and small entities as those employing between one and 50 individuals with an annual turnover not exceeding Sh5 million. Medium entities are characterized by 51 to 99 employees and an annual turnover ranging from Sh5 million to Sh50 million. Large entities are those with over 99 employees and an annual turnover exceeding Sh50 million. The regulator has previously advised organizations to submit their renewal applications at least 30 days prior to their certificate's expiry date, rather than waiting until the registration has lapsed.

The ODPC emphasizes that the registration requirement extends beyond mere administrative compliance; it forms a critical component of Kenya's overarching strategy to safeguard individuals' privacy rights. This framework is particularly vital as digital services expand and the collection of personal information becomes more pervasive. The ODPC's core mandate includes regulating the processing of personal data, actively protecting the privacy of individuals, and ensuring robust compliance with the Data Protection Act.

In line with its commitment to effective oversight, the Office of the Data Protection Commissioner has also been actively enhancing its internal operational capabilities. In July, Data Commissioner Kassait presided over the launch of the ODPC’s ISO 9001:2015 Quality Management System, signaling a dedication to strengthening its systems for better regulatory enforcement and service delivery.

Lawyers and compliance officers must immediately advise clients operating in Kenya to verify the status of their data protection registration certificates and initiate renewal processes before the September 11, 2026 deadline to avoid enforcement action and penalties from the ODPC.

Source: Original reporting via {source}