Register as a data controller or data processor (ODPC)
Office of the Data Protection Commissioner · sources read 1 Oct 2026
Create an account on the ODPC registration portal (dataportal.odpc.go.ke), apply as a data controller, a data processor or both, and pay the fee for your size: KSh 4,000, 16,000 or 40,000. If approved, ODPC issues the certificate within 14 days and it lasts 24 months.
- Fee
- KSh 4,000Micro and small (1-50 staff, turnover up to KSh 5M)KSh 16,000Medium (51-99 staff, turnover KSh 5M-50M)KSh 40,000Large (over 99 staff, turnover over KSh 50M)KSh 4,000Public entitiesKSh 4,000Charities and religious entities
- How long
- Within 14 days of approval
- Where
- Online on the ODPC registration portal (dataportal.odpc.go.ke)
What you need
- A copy of your establishment documents (e.g. certificate of incorporation)
- A description of why you process personal data (e.g. payroll, invoicing, KYC)
- The kinds of personal data you hold and whose data it is (staff, clients, students, suppliers)
- Your previous year's annual turnover or revenue
Steps
- Go to dataportal.odpc.go.ke and sign up for an account.
- Apply to register as a data controller, a data processor, or both, and pay the fee for your turnover or staff size.
- Fill in your organisation's details and describe how you process personal data.
- ODPC checks your application. If approved, you get a certificate and your name goes on the public register of data handlers.
Watch out
- If you're both a controller and a processor, you register twice and pay two fees.
- The certificate is valid for 24 months, so diarise the renewal.
- If any of your details change, tell ODPC in writing within 14 days at registration@odpc.go.ke.
Who can apply
- Public and private organisations, and individuals, that process people's personal data.
- Small players are exempt only if annual turnover is below KSh 5 million AND they have fewer than 10 staff.
- Some sectors must register whatever their size, including health, education, betting, financial services, insurance, transport, property, telecoms, hospitality, churches and public bodies.
- Organisations outside Kenya that process data of people living in Kenya must also register.
Official sources (4)
- FAQs: Registration of Data Controllers and Processors odpc.go.ke · read 1 Oct 2026
- Data Protection Compliance (Are you Registered as a Data Handler?) odpc.go.ke · read 1 Oct 2026
- The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 odpc.go.ke · read 1 Oct 2026
- Office of the Data Protection Commission - Data Handler Registration dataportal.odpc.go.ke · read 1 Oct 2026