On 31st March 2022, the Office of the Data Protection Commissioner (ODPC) issued a press notice notifying the public that the Regulations on the Registration of Data Controllers and Processors will come into effect from 14th July 2022. The Regulations inter alia, set out the requirements and procedures for registration as a data controller, data processor or both. Following this announcement, data controllers and processors will now be required to register as such with the ODPC on/around 14th July, 2022.
Entities with a turnover/revenue of below Kshs. five million (5,000,000) or those which have less than 10 employees are exempted from mandatory registration. The exemption does not apply for entities involved in the financial sector, health, gambling, hospitality industry, telecommunication sector or service providers, educational institutions, politics, property management including selling of land, direct marketing and entities dealing with genetic data.
The scheduled commencement date of this registration comes on the heels of the passage of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021, and Data Protection (General) Regulations, by the Parliamentary Committee on Delegated Legislation on 17th February, 2022. The latter two are already in force and data controllers and processors are now required to fulfill their obligations as pertains to the realisation and protection of personal data of data subjects.
