The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (the Registration Regulations) came into effect on 14 July 2022 and give effect to Part III of the Data Protection Act, 2019 (DPA) on the registration of data controllers and data processors. Please see our previous alert on all the Data Protection Regulations here.

We outline below what you need to know about the registration process.

Who is required to register?

All data controllers and data processors who are established in Kenya, or who process personal data about data subjects located in Kenya, and meet the mandatory registration thresholds set out in the Registration Regulations will be required to register with the Data Commissioner.

Regulation 13 of the Registration Regulations provides that it shall be mandatory for the following persons to register with the Data Commissioner:

• those with an annual turnover or revenue of more than KES 5 million (approximately US$50,000) and more than 10 employees;
• those who have an annual turnover or revenue of less than KES 5 million (approximately US$50,000) but with more than 10 employees;
• those who have an annual turnover or revenue of more than KES 5 million (approximately US$50,000) but with less than 10 employees; and
• those engaging in activities outlined in the Third Schedule to the Registration Regulations.

The registration process

The Office of the Data Protection Commissioner (the Data Commissioner) has put in place an online portal through which registration of data controllers and data processors is to be carried out (the Portal).

The Portal has been made available and can be accessed here.

The Data Commissioner has issued a guidance note, available here, providing the step-by-step registration process.

Conclusion

It is important for data controllers and data processors who meet the mandatory registration thresholds set out above to make arrangements to register immediately with the Data Commissioner to avoid the onerous penalties for default.

The content of the above publication is for general information only and is not intended to be in the nature of legal advice. Information contained in this publication should not be acted upon in any specific situation without appropriate legal advice.

If you have any questions and/or concerns regarding the Registration Regulations or the DPA in general, please do not hesitate to contact Daniel Wanjau, Peter Okaalet Jr or Roselyne Mugo.