Data Protection Officer (DPO): who needs one and what to do
Office of the Data Protection Commissioner; Data Protection Act, 2019 · sources read 4 Oct 2026
The Data Protection Act lets an organisation appoint a DPO, especially a public or private body, one that regularly monitors people, or one that handles sensitive data. If you have one, publish their contacts on your website and send their details to ODPC on the DPO Contact Submission Form (registration@odpc.go.ke).
- Where
- Send DPO details to ODPC: registration@odpc.go.ke or Britam Towers, 12th Floor, Nairobi
Steps
- Decide if you need a DPO. The Act names three cases: processing by a public or private body (except courts acting as courts), core work that needs regular and systematic monitoring of people, or core work handling sensitive personal data.
- Choose a qualified person: an internal staff member, an external DPO, or one shared DPO for a group of related companies. An external DPO must stay independent and free of conflicts.
- Publish the DPO's contact details on your website.
- Send the DPO's details to ODPC on the DPO Contact Submission Form, by email to registration@odpc.go.ke or to Britam Towers, 12th Floor, Nairobi.
Watch out
- The Act asks for relevant qualifications. ODPC's 2026 guidance strongly encourages local and international certifications.
- ODPC says the DPO should report directly to top management, such as the CEO, MD or the Board.
- A group of companies can share one DPO, as long as every company can reach them.
Who this covers
- Who can be a DPO: a person with relevant academic or professional qualifications, including knowledge and technical skills in data protection.
- A DPO can be one of your staff and do other work too, as long as it doesn't create a conflict of interest.
Official sources (2)
- Data Protection Act, 2019 (No. 24 of 2019) odpc.go.ke · read 4 Oct 2026
- Guidance Notes for Data Protection Officer (DPOs), 2026 odpc.go.ke · read 4 Oct 2026