ODPC Registration for Airbnb Hosts 2026: Fees, Guest Data

Updated 2 November 2026

ODPC registration matters for Airbnb and short-stay hosts because the Office of the Data Protection Commissioner lists “hospitality industry firms” and “property management” among the sectors that must register as data controllers whatever their size, so the usual exemption for businesses with under KSh 5 million in revenue and fewer than ten staff does not apply to them. Registration costs KSh 4,000 for a micro or small business, KSh 16,000 for a medium one and KSh 40,000 for a large one, and the certificate lasts 24 months.

This guide explains when a short-stay business has to register, what it costs, and what the Data Protection Act 2019 says about collecting guests’ IDs, phone numbers and CCTV footage. Sources: Data Protection Act 2019, the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021 (L.N. 265 of 2021), and ODPC’s FAQs, read 2 November 2026.

Who needs ODPC registration

Section 18 of the Data Protection Act says no person may act as a data controller or data processor unless registered with the Data Commissioner, who sets thresholds. Regulation 13 exempts businesses with annual revenue below KSh 5 million and fewer than ten employees, but the exemption does not apply to anyone processing data for the purposes in the Third Schedule. ODPC’s list of those purposes includes:

• hospitality industry firms;
• property management, including the selling of land;
• crime prevention, including operating security CCTV systems;
• transport services firms, including ride-hailing apps; and
• education, health care, financial services, insurance, betting and direct marketing, among others.

So a company or business name that runs serviced apartments or an Airbnb portfolio, or a property manager that runs units for owners, should plan to register. Hosts who run short-stays as a formal business also need a TRA licence; see our guide to the Airbnb TRA licence rules.

ODPC registration fees

ODPC says you must meet both conditions to move up a tier. A host business with KSh 8 million in revenue but only ten staff still registers as micro and small and pays KSh 4,000. If you act as both a data controller and a data processor (for example a management company handling guest data for owners), ODPC says you register twice and pay two fees.

How to register

1. Apply online through odpc.go.ke using Form DPR1.
2. Attach your establishment documents (certificate of incorporation or business name), contact details, a description of why you process personal data and the categories of data.
3. Pay the fee for your tier.
4. ODPC issues a certificate within 14 days if satisfied; it is valid for 24 months, and you renew with Form PR 2.

ODPC publishes a list of registered data handlers on its website, so guests and booking partners can check you.

What the law says about guest data

Registration is only the start. Every host, registered or not, must follow the Act’s principles in section 25. In practice:

• Collect only what you need. Personal data must be “adequate, relevant, limited to what is necessary”. Ask whether you really need a photo of every guest’s ID or just the details for your guest register.
• Tell guests why. Section 29 requires you to inform people, before collecting their data, of the purpose, their rights and who else will receive it, for example the platform or the police.
• Have a legal basis. Section 30 allows processing with consent, to perform a contract (the booking) or to comply with a legal obligation.
• Delete on time. Data must not be kept longer than necessary for its purpose.
• Respect guest rights. Guests can ask to see, correct or delete false data about them (section 26).
• CCTV: cameras in common areas count as processing. Never place them where guests expect privacy, and tell guests they are there.

Breaches and penalties

If guest data is accessed by an unauthorised person and there is a real risk of harm, section 43 requires you to notify the Data Commissioner within 72 hours and tell affected guests in writing. Under section 63, the Data Commissioner can fine up to KSh 5 million, or for an undertaking up to 1% of the previous year’s turnover, whichever is lower. Our explainer on reporting to ODPC shows how complaints work in practice.

Taxes are a separate obligation; see Airbnb tax in Kenya. If you are weighing whether to start, our guide to setting up an online business covers payments and a website.

Frequently asked questions

How much is ODPC registration?

KSh 4,000 for micro and small data controllers or processors, KSh 16,000 for medium and KSh 40,000 for large, according to ODPC.

Are Airbnb hosts exempt from ODPC registration?

The small-business exemption does not apply to hospitality industry firms or property management, which ODPC lists among sectors that must register regardless of size.

How long is an ODPC certificate valid?

24 months from the date of issue, after which you apply for renewal.

Can a host keep copies of guests’ IDs?

Only if necessary for a stated purpose, with guests informed, kept securely and deleted when no longer needed, under sections 25 and 29 of the Data Protection Act.

Sources: ODPC FAQs; Data Protection Act 2019, sections 18, 25, 26, 29, 30, 43 and 63; Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021, regulations 4, 11 and 13. Read 2 November 2026. This is general information, not legal advice.