Updated 2 November 2026
ODPC registration is the first step in data protection compliance for SMEs in Kenya: must you register with the Office of the Data Protection Commissioner (ODPC)? Most businesses must. You are only exempt if your annual turnover is below KSh 5 million AND you have fewer than 10 employees, and even then not if you work in sectors such as education, health, hospitality, financial services, property, transport or CCTV security. For a small business, ODPC registration costs KSh 4,000, the certificate lasts 24 months and renewal costs KSh 2,000. Below is the full fee table, how to register and the checklist that keeps you compliant after registration.
Updated November 2026. Fees and rules are from the ODPC’s registration FAQs and the Data Protection Act, 2019, checked 2 November 2026.
In this guide
Is ODPC registration mandatory for your SME?
Section 18 of the Data Protection Act, 2019 and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 require organisations and individuals that process personal data to register. Almost every business does: payroll, customer phone numbers, M-Pesa records and CCTV footage all count as personal data.
The exemption needs both conditions: annual turnover or revenue below KSh 5 million and fewer than 10 employees. If you meet only one, you must register.
No exemption, whatever your size, if you process data for any of these purposes (ODPC list):
- Education, health administration and patient care, hospitality
- Financial services, insurance, retirement benefits, credit bureaus, debt collection and factoring
- Property management, including selling land
- Crime prevention, including running CCTV and private security
- Gaming and betting, direct marketing, telecoms and internet access
- Transport services, including ride-hailing apps
- Faith-based institutions, political canvassing, public bodies and genetic data
So a small school, clinic, guest house, Airbnb, chama-lending business or estate agent must register even with two staff.
ODPC registration fees 2026
| Category | Employees and turnover | Registration fee | Renewal fee (every 24 months) |
|---|---|---|---|
| Micro and small | 1–50 employees, turnover up to KSh 5 million | KSh 4,000 | KSh 2,000 |
| Medium | 51–99 employees, KSh 5,000,001–50 million | KSh 16,000 | KSh 9,000 |
| Large | More than 99 employees, over KSh 50 million | KSh 40,000 | KSh 25,000 |
| Public entities | Any size | KSh 4,000 | KSh 2,000 |
| Charities and religious entities | Any size | KSh 4,000 | KSh 2,000 |
To move into a higher tier you must meet both its staff and turnover tests. A firm with KSh 8 million turnover and 10 staff therefore registers as micro and small and pays KSh 4,000. M-Pesa and card payments add a KSh 50 convenience fee; bank transfers and RTGS do not. If you act as both a data controller (you decide why data is collected) and a data processor (you handle data for clients, for example a payroll bureau or IT provider), you register twice and pay twice.
How to do ODPC registration: step by step
- Gather your documents: certificate of registration or incorporation, contact details, and your last annual turnover figure. If you have not yet registered the business, see how to register a limited company on BRS.
- Describe your processing: why you collect data (payroll, invoicing, KYC, bookings), what data (names, ID numbers, phone numbers), whose data (staff, customers, suppliers) and who you share it with (KRA, SHA, banks).
- List your safeguards: access controls, passwords, a visitors’ log, a privacy policy and an information security policy.
- Apply online on the ODPC data portal and pay.
- Receive your certificate. The ODPC issues it within 14 days if satisfied, or writes within 21 days with reasons if it rejects the application.
- Diarise renewal at least 30 days before the certificate’s 24-month expiry, and tell the ODPC within 14 days if your details change.
After registration: the SME compliance checklist
- Privacy notice: tell customers and staff what you collect, why, how long you keep it and how to complain. Put it on your website and forms.
- Consent and marketing: get clear consent before sending marketing SMS or emails, and give an easy opt-out.
- Collect less: don’t copy ID cards or ask for data you don’t need.
- Secure it: strong passwords and two-factor login on email, payroll and M-Pesa business accounts; lock paper files; limit who can see customer lists.
- Contracts with processors: your payroll bureau, cloud host or IT firm should have a written data processing agreement.
- Breaches: the Act requires you to notify the Data Commissioner within 72 hours of becoming aware of a breach that risks harm, and to tell affected people where needed.
- Data subject requests: have a simple process to respond when a customer asks to see, correct or delete their data.
- Retention: delete data you no longer need, but keep tax records for the period KRA requires.
The website side matters too: forms that collect phone numbers or IDs should run on HTTPS. If you are setting up a business site, our legal requirements to start a business guide covers the other registrations.
What happens if you don’t comply?
The Data Commissioner can investigate complaints, issue enforcement notices and impose administrative fines of up to KSh 5 million or 1% of the previous year’s annual turnover, whichever is lower. Digital lenders are a common case: see how borrowers report loan app harassment to the ODPC and CBK.
Questions to ask an IT or compliance provider
- Will you prepare our ODPC registration and privacy notice, and what is the fixed fee?
- Do you sign a data processing agreement, and where are our files stored?
- Who is notified, and how fast, if your systems are breached?
- Can you train staff on phishing and password basics?
Frequently asked questions
How much is ODPC registration for a small business?
KSh 4,000 for micro and small data controllers or processors (1 to 50 employees, turnover up to KSh 5 million), plus KSh 50 if you pay by M-Pesa or card.
Is my small business exempt from ODPC registration?
Only if annual turnover is below KSh 5 million and you have fewer than 10 employees, and you are not in a listed sector such as education, health, hospitality, financial services, property or transport.
How long is an ODPC certificate valid?
24 months. Apply to renew at least 30 days before it expires; renewal costs KSh 2,000 for small entities.
How long does ODPC registration take?
The ODPC says it issues the certificate within 14 days once satisfied, and notifies rejections within 21 days.
What is the fine for breaking the Data Protection Act?
Up to KSh 5 million or 1% of the previous year’s turnover, whichever is lower, as an administrative fine.
Sources: Office of the Data Protection Commissioner, registration FAQs; Data Protection Act, 2019 (sections 18, 43, 63); Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. Checked 2 November 2026. General information, not legal advice.
Prefer WhatsApp? Follow Business Radar on WhatsApp
Weekly, free. We only use your email for this newsletter and you can unsubscribe in one click. Privacy policy.
