Data Protection Impact Assessment (DPIA): when you need one and how to file it with ODPC
Office of the Data Protection Commissioner · sources read 4 Oct 2026
If your processing of personal data is likely to be high risk, do a DPIA before you start and submit the report to ODPC at least 60 days before processing begins. ODPC's Third Schedule template and DPIA guidance note show what to include.
- Fee
- We couldn't confirm a fee from the official page. Check it there before you pay.
- How long
- If ODPC doesn't reply within 60 days of submission, the report is treated as approved
- Where
- Office of the Data Protection Commissioner, Britam Towers, 12th Floor, Hospital Road, Upperhill, Nairobi (info@odpc.go.ke)
What you need
- A completed DPIA using the Third Schedule template (Data Protection (General) Regulations, 2021) or ODPC's guidance note template
- In the report: a description of the processing and its purpose, why it is necessary and proportionate, the risks to people, and the safeguards you will use
Steps
- Check if your project is high risk. Examples: automated decisions with legal effect, biometric or genetic data, sensitive data or children's data, large-scale processing, combining datasets, monitoring public places, or new technology.
- Fill in the DPIA template before you start processing (or before a big change to an existing process).
- Submit the DPIA report to ODPC at least 60 days before the processing starts.
- ODPC may send recommendations to add before you start. If you hear nothing within 60 days of submitting, you may start and the report is treated as approved.
Watch out
- If the DPIA shows the processing would still be high risk, you must consult the Data Commissioner before you start.
- ODPC can audit you later to check you are following the report and any recommendations it gave.
Who can apply
- Data controllers and data processors whose processing is likely to be high risk to people's rights and freedoms.
Official sources (4)
- The Data Protection Act, 2019 (No. 24 of 2019) odpc.go.ke · read 4 Oct 2026
- The Data Protection (General) Regulations, 2021 odpc.go.ke · read 4 Oct 2026
- ODPC Guidance Note on Data Protection Impact Assessment odpc.go.ke · read 4 Oct 2026
- E-Services (contact details) odpc.go.ke · read 4 Oct 2026