Do I Need to Register My Business with the ODPC?

If you run a business in Kenya and handle any customer information — names, phone numbers, M-Pesa numbers, delivery addresses — this question has probably crossed your mind at some point: do I actually need to register with the Office of the Data Protection Commissioner (ODPC)?

You're not alone. In the research behind Cybersentinel, this came up again and again with Nairobi business owners. Most people had heard of Kenya's Data Protection Act. Very few knew whether it actually applied to them, or what to do about it if it did.

Here's the short version.

Kenya's Data Protection Act requires most businesses that collect or process personal data to register with the ODPC. But there's an exemption — some small businesses don't have to register at all, based on a few factors:

• The size of your business — very small operations can fall under the exemption threshold, based on annual turnover and number of employees.
• What kind of data you handle — sensitive categories (health records, financial data, children's data) make the exemption less likely regardless of size.
• Your sector — some sectors are treated differently under the Act's regulations, independent of size.

If none of those apply and your business is genuinely small, you may be exempt. If any of them do, registration is likely required — and it's a straightforward, inexpensive process, not a scary one.

Why this matters beyond "following the rules."

Registering (or confirming you're exempt) isn't just paperwork — it's the first real signal that you're handling customer information responsibly. In our research, this was one of the clearest gaps: business owners who genuinely cared about protecting customer data, but had never actually checked where they stood with the law. Caring isn't the same as knowing your status, and not knowing tends to become a problem at the worst possible time — a customer complaint, a data breach, a partner's due-diligence check.

What to do next.

This article can't give you a definitive yes or no — the exemption depends on specifics about your business that only you (or the ODPC directly) can confirm. The ODPC's own website has current registration guidance, and for anything borderline, a quick check with a lawyer familiar with Kenyan data protection law is worth the small cost.

What Cybersentinel does is make the first step easy: a free, 2-minute check that walks through the same questions — your size, your data types, your sector — and gives you a clear starting answer, plus a plain-language explanation of why.