Last reviewed October 2026
- Issued by
- The Office of the Data Protection Commissioner (ODPC)
- Valid for
- The period stated on the certificate under the registration regulations; check the current term with the ODPC
- Who needs it
- Firms that collect or handle personal data above the thresholds or in the sectors the regulations name
- Where to apply
- The ODPC's online registration portal, linked from odpc.go.ke
- Cost
- A registration fee set by the regulations, which depends on the size of the organisation; check the current schedule with the ODPC
What it is
The Data Protection Act, 2019 requires organisations that handle personal data to register with the Office of the Data Protection Commissioner, unless they fall outside the thresholds set by the registration regulations. A data controller decides why and how personal data is used; a data processor handles personal data on a controller's instructions. A firm can be both, and registers for each role it plays.
Registration gives the firm a certificate that a buyer can ask for and check. It is not a statement that the firm's data handling is sound, but it is the first thing a buyer looks for.
Who must register, and when tenders ask for it
The regulations set thresholds by turnover and number of employees, and list sectors where registration is required whatever the firm's size, such as health, education, financial services, telecommunications and others that handle sensitive data. Check the current thresholds and list with the ODPC, because they decide whether registration is mandatory for your firm.
Tenders ask for an ODPC certificate when the contract will put personal data in the supplier's hands: ICT systems and hosting, payroll and HR services, call centres, health and insurance services, security services with CCTV, printing of personal records, surveys and data collection. Contracts often go further and require a data-processing agreement.
How to get it
- Work out whether the firm acts as a controller, a processor or both, and for which kinds of personal data.
- Gather the company documents: certificate of incorporation, CR12 and KRA PIN, plus the firm's turnover and staff numbers for the threshold.
- Describe the processing: the purposes, the categories of people and data, where data is stored and whether it leaves Kenya, and the security measures in place.
- Apply on the ODPC's online portal, choose the role, upload what it asks for and pay the fee it states.
- Download the certificate once issued, keep it in the vault, and renew before it expires or when the processing changes materially.
Why bids fail over it
- The tender asked for a processor certificate and the firm held only a controller registration, or the other way round.
- The certificate had expired by the closing date.
- The firm attached an application acknowledgement instead of the issued certificate.
- The certificate belonged to a parent company or partner rather than the bidder.
- The bid said nothing about how personal data would be protected where the evaluation scored it.
How Tendakazi helps
The vault holds the ODPC certificate with its role and expiry and reminds you before it lapses. When our analysts read a tender that touches personal data, they flag the registration and any data-protection requirements so you see them before the bid is built.
Our statutory desk can prepare and lodge the registration or renewal as a quoted service. We help with the filing; for advice on your obligations under the Act, speak to an advocate or data protection adviser.
Questions
Do small firms have to register with the ODPC?
It depends on the thresholds and the sector lists in the registration regulations. Some sectors must register whatever their size; check with the ODPC.
What is the difference between a data controller and a data processor?
A controller decides why and how personal data is used. A processor handles it on the controller's behalf and instructions.
Do I need both registrations?
Only if the firm plays both roles. Many suppliers are controllers for their own staff data and processors for clients' data.
Does the certificate expire?
Yes. It is valid for the period the regulations set and must be renewed; check the date on your certificate.
Is registration enough to win a data-heavy tender?
It is usually a mandatory minimum. Buyers may also score your security measures and ask for a data-processing agreement.
Our statutory desk prepares and lodges your ODPC registration as a controller, processor or both, and the vault watches the renewal.
New firms get 50% off every service for their first 30 days.
Read next
General information for suppliers, not legal, tax or financial advice. Procurement law, regulations, thresholds and government systems change: check the current rules with the procuring entity, the Public Procurement Regulatory Authority (PPRA), the National Treasury or KRA, and speak to an advocate or tax adviser about your own case.