The Data Protection Act in Kenya: What It Asks of Your Website, and Who Has to Register

Your website has a contact form. Somebody types their name, their phone number and a line about what they need, and it lands in your inbox. That is personal data, you are the one who collected it, and Kenyan law has something to say about it.

Most business owners we talk to assume the Data Protection Act is a problem for banks and hospitals. It is not. It is written around what you do with people's details, not how big you are. This piece sets out who has to register with the Data Protection Commissioner, who does not, and what the law still asks of you either way. Everything below is taken from the Data Protection Act, 2019 and from the registration Regulations themselves, which you can open and read, rather than from anybody's summary of them.

Why This Lands on Your Website

A website is usually the busiest place a Kenyan business collects personal information. The contact form, the quote request, the newsletter signup, the WhatsApp click, the booking calendar, the checkout, the comment box. Each one takes details from a person and puts them somewhere: your inbox, a database, a plugin's table, a mailing tool, somebody's phone.

That last part is where most of the risk sits. The form is not the problem. Where the entries go afterwards, who can read them, how long they stay and whether anyone ever deletes them, that is the problem. We have opened sites where five years of enquiries sat in a plugin table that nobody knew existed, including the owner.

Three Words the Law Uses

The Act leans on three terms. They are worth getting straight because the rest of it hangs off them.

• Personal data is information that identifies a living person. A name, a phone number, an email address, an ID number, a photograph, a location. On a website it also covers things people do not think of as personal, like an account username or a record of what somebody bought.
• A data controller decides why and how personal data gets used. If it is your business, your form and your decision to collect it, you are the controller. This is almost always the business owner, not the web developer.
• A data processor handles the data on the controller's instructions. Your hosting company is a processor. So is your email provider, your mailing list tool, and yes, so are we when we maintain your site.

One business can be both. A marketing agency is a controller for its own enquiry form and a processor for its clients' customer lists.

Who Must Register, and Who Is Exempt

Registration is governed by the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. Regulation 13(2) sets the exemption, and the exact wording matters:

Read the word and at the end of (a). Both conditions have to be true. Under five million shillings and fewer than ten employees. Meeting one of them is not enough.

So a consultancy turning over three million shillings with four staff is exempt. A church office with eight staff and an annual budget of seven million shillings is not, because it fails the money test. A design studio with twelve staff and two million shillings coming in is not, because it fails the headcount test.

The Regulations also say how to measure the money. Revenue is the total income of a profit making entity for the year immediately before the year of registration. For a non profit making entity, turnover means the annual budget actually used over the same period. That second definition catches a lot of organisations out, because an NGO with a large grant it mostly spent is being measured on the spending, not on profit it never made.

The Twelve Purposes That Cancel the Exemption

Here is the part almost nobody knows about. Regulation 13 goes on to say the exemption does not apply where the entity processes personal data for a purpose set out in the Third Schedule, no matter how small it is. The Third Schedule is headed "Thresholds for mandatory registration" and lists twelve purposes:

1. Canvassing political support among the electorate.
2. Crime prevention and prosecution of offenders, including operating security CCTV systems.
3. Gambling.
4. Operating an educational institution.
5. Health administration and provision of patient care.
6. Hospitality industry firms, but excluding tour guides.
7. Property management, including the selling of land.
8. Provision of financial services.
9. Telecommunications network or service providers.
10. Businesses that are wholly or mainly in direct marketing.
11. Transport services firms, including online passenger hailing applications.
12. Businesses that process genetic data.

Look down that list against the kind of business you run. A two room private academy is operating an educational institution. A single clinic is health administration and patient care. A guest house is a hospitality firm. An agent selling plots is property management. A small sacco is providing financial services. A matatu sacco or a shuttle company is a transport services firm. None of them get the small business exemption, whatever their turnover.

Item two is the one that surprises people most. If you run security cameras, you are processing personal data for crime prevention, and that is on the list by name. The same logic reaches the paper visitor book at your reception, which we have written about separately because it deserves its own look.

What Registration Costs

The Second Schedule to the same Regulations sets the fees. Registration is paid once. Renewal comes round after every two years.

For most Kenyan small businesses that is four thousand shillings once and two thousand every second year. Set against a penalty measured in millions, the arithmetic is not difficult.

The Trap in the Numbers

Compare the two tables above and you will spot something. The exemption test asks for fewer than ten employees. The micro and small fee band runs from one to fifty employees. They are different numbers doing different jobs, and people conflate them constantly.

A firm with twenty staff and three million shillings in revenue is not exempt, because twenty is not fewer than ten. But it still sits in the micro and small band, so it registers and pays four thousand shillings. Assuming the ten employee figure defines your fee category, or that being in the cheapest band means you did not need to register, is the error we see repeated in summaries online.

Exempt From Registering Is Not Exempt From the Act

This is the single most important line in the Regulations for a small business, and it is easy to miss. Regulation 13(3) says that a controller or processor exempt under 13(2) is still required to comply with Part IV and Part VI of the Act.

In plain terms: not having to put your name on a register does not release you from the law. The duties about how you treat people's data still apply in full. You still need a lawful reason for collecting what you collect. You still have to tell people what you are doing with it. People still have the right to ask what you hold about them and to have it corrected. You still cannot keep it forever for no reason, and you still have to keep it secure.

So "we are too small to register" is sometimes a correct statement about registration and never a correct statement about compliance.

The Seventy Two Hour Clock

If personal data you hold is exposed, section 43(1)(a) of the Act requires you to notify the Data Commissioner "without delay, within seventy two hours of becoming aware of such breach".

Seventy two hours is not long. The clock starts when you become aware, not when the breach happened, and in practice the gap between those two moments is where businesses lose. A site that was quietly compromised in March and noticed in September has a much harder conversation than one with monitoring that caught it the same week. That is the real argument for keeping a site monitored: not tidiness, but knowing early enough to be able to report on time.

On penalties, section 63 allows an administrative fine of up to five million shillings, or in the case of an undertaking, up to one per centum of its annual turnover of the preceding financial year, whichever is lower.

Separately, the Office of the Data Protection Commissioner has been pressing registration harder through 2026, including a notice during the year giving controllers with expired certificates a date to renew by. We have not independently verified the current state of that notice, so treat it as context rather than a deadline, and check odpc.go.ke for where things actually stand today.

What This Means for the Website Itself

Compliance is mostly a business exercise rather than a coding one, but a handful of it is genuinely the website's job. These are the things we look at on a Kenyan site.

If you want a quick read on the technical half of that, our free website checkup covers HTTPS, security headers and what your pages expose, with no account and no sales call. It will not tell you whether you must register, but it will tell you whether the basics under your forms are sound.

Frequently Asked Questions

Does the Kenya Data Protection Act apply to a small business website?

Yes. The Act is built around what you do with people's personal data, not the size of the business. If your website collects names, phone numbers or email addresses, you are handling personal data and the Act applies. Size only affects whether you must register with the Data Protection Commissioner, and even a business that is exempt from registering still has to comply with Part IV and Part VI of the Act under regulation 13(3) of the 2021 Registration Regulations.

Who has to register with the ODPC in Kenya?

Under regulation 13(2) of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, you are exempt only if you have an annual turnover or revenue below five million shillings and fewer than ten employees. Both must be true. On top of that, the exemption does not apply at all if you process personal data for any purpose in the Third Schedule, which includes operating an educational institution, health administration and patient care, hospitality firms, property management including selling land, provision of financial services, telecommunications, businesses wholly or mainly in direct marketing, transport services including online hailing apps, gambling, political canvassing, genetic data, and crime prevention including running security CCTV.

How much does ODPC registration cost?

The Second Schedule to the 2021 Regulations sets the fees. Micro and small entities, meaning 1 to 50 employees and turnover or revenue up to five million shillings, pay KES 4,000 to register and KES 2,000 to renew. Medium entities with 51 to 99 employees and turnover between KES 5,000,001 and 50 million pay KES 16,000 and KES 9,000. Large entities above 99 employees and above KES 50 million pay KES 40,000 and KES 25,000. Public entities offering government functions pay KES 4,000 and KES 2,000 regardless of size. Registration is paid once and renewal falls due after every two years.

If I have fewer than ten employees, am I definitely exempt?

No, for two reasons. First, the exemption needs both conditions: fewer than ten employees and under five million shillings in turnover or revenue. A small team with a large turnover does not qualify. Second, the exemption is cancelled entirely if you process personal data for a purpose listed in the Third Schedule, so a three person private school or a two person clinic must register regardless. There is also a common mix up worth avoiding: the ten employee figure is the exemption test, while the fee bands start at one to fifty employees. A firm with twenty staff is not exempt but does still pay the lowest fee.

How long do I have to report a data breach in Kenya?

Section 43(1)(a) of the Data Protection Act requires notification to the Data Commissioner without delay, within seventy two hours of becoming aware of the breach. The clock starts when you become aware rather than when it happened, which is why monitoring matters: a site compromised months before anyone noticed makes that deadline much harder to meet honestly.

What is the penalty for breaking the Data Protection Act?

Section 63 of the Act provides for an administrative fine of up to five million shillings, or in the case of an undertaking, up to one per centum of its annual turnover of the preceding financial year, whichever is lower. Set that against registration fees of four thousand shillings for most small businesses and the sensible order of work is clear.

Is my web developer or hosting company responsible instead of me?

No. If it is your business, your form and your decision to collect the information, you are the data controller and the responsibility is yours. Your host, your email provider, your mailing tool and your maintenance company are data processors acting on your instructions. That does not move the duty off you, but it does mean choosing processors carefully is part of your own compliance, because you are answerable for who you handed the data to.