Registration of data controllers and processors kicks off today 14 July 2022. As highlighted in our update, data controllers and data processors are expected to register online with the Office of the Data Protection Commissioner (the ODPC) via the ODPC website from 14th July 2022 (the Commencement Date) in compliance with the Data Protection Act, 2019 (DPA) and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (Registration Regulations).
As a reminder, the registration process requires data controllers and data processors to outline the data processing activities being undertaken and the corresponding safety measures to ensure data privacy. It is paramount for data controllers and data processors to:
- understand their obligations under the DPA and its accompanying regulations and consequently to implement requisite measures towards meeting these obligations;
- ensure that information captured in the registration form and accompanying documents is accurate and sufficient; and
- continuously ensure that they are fulfilling their ongoing obligations under the DPA and its regulations, including notifying the ODPC of any changes to registration particulars and submitting timely renewal applications.
The application must be accompanied by a copy of the establishment documents or proof of registration such as CR12, partnership deed, or a copy of an ID for individuals that are required to register. Entities that act as both data controllers and data processors will need to submit 2 separate registration applications. Importantly, entities and individuals (unless exempt), cannot act as data controllers or data processors in Kenya unless they have registered with the ODPC.
The ODPC has published information on their website and their Twitter handle which clients may find helpful.
