If your business handles personal data in Kenya, you are very likely required to register as a data controller or data processor with the Office of the Data Protection Commissioner. We prepare, file and follow up your application end to end — one quoted price, agreed before we start, no hourly billing.
96 ODPC determinations in 2025 — nearly double 2024 — with penalties as high as KES 2.9M in reported cases. See what triggered them → · Browse 30+ ODPC & High Court case briefs →
Registering a SACCO? You're dual-regulated by SASRA and the ODPC. See where the two regimes overlap →
The ODPC sets its own statutory fee by entity size — our professional fee for preparing and filing your application is fixed the same way. You pay both: our one-time professional fee, and the statutory ODPC fee direct to the Commissioner.
Public entities, charities and religious organisations must register regardless of turnover; ask us which tier applies. Statutory fees are set by the ODPC and paid directly to the Commissioner — we don't mark these up. Complex files (multiple entities, cross-border groups, or unresolved data-mapping disputes) may attract a revised quote, always agreed with you before any extra work begins.
Four steps, start to certificate.
A short intake form covering headcount, turnover, and what personal data you collect. Takes about 10 minutes.
You get one quoted amount for our professional fee, in writing, before any work begins — plus the statutory ODPC fee for your tier.
We draft your data inventory and processing-activity register, complete the DPR1 form, and submit it through the ODPC's online portal.
We track the application, respond to any ODPC clarification requests within the included rounds, and send you the certificate once issued.
Most SACCOs and SMEs need both, at different points. Here's the honest split.
| ODPC Registration | Compliance Retainer | |
|---|---|---|
| What it is | A one-time regulatory filing — your data controller/processor certificate. | Ongoing outsourced DPO support, month to month. |
| Frequency | Filed once, renewed every 2 years. | Continuous — quarterly or monthly check-ins depending on tier. |
| What it covers | Getting you legally on record with the ODPC. | Staying compliant after that — policies, DPIAs, breach response, DSRs, ODPC liaison. |
| Best for | Businesses that need to be registered but have simple, low-risk processing. | Any organisation handling member, customer or employee data at real scale — especially SACCOs. |
| Typical path | Register first (or alongside), then move to a retainer once you're handling live member/customer data day to day. | |
Any entity that determines the purpose and means of processing personal data (a controller), or processes data on behalf of one (a processor), must register — subject to limited exemptions based on employee numbers and turnover. Some categories, including political canvassing, direct marketing, betting, health, financial and telecoms entities, must register regardless of size.
The statutory fee, paid directly to the ODPC, is KES 4,000 for micro and small entities, KES 16,000 for medium entities, and KES 40,000 for large entities, renewable every two years. This is separate from our fixed professional fee shown above.
Operating as an unregistered controller or processor where registration is mandatory is an offence under the Data Protection Act, 2019, and exposes you to ODPC enforcement action and difficulty proving compliance to partners, funders or regulators.
We typically file within 3–5 working days of receiving a complete file from you. ODPC review and certificate issuance generally takes around 14 days from a complete application, though this can vary with volume at the Commissioner's office.
Yes. You're quoted one amount up front for your tier, agreed before we start. No hourly billing, no surprise invoices. The only variable is the statutory ODPC fee, which is set by the Commissioner, not by us.
Run through our free ODPC Compliance Checklist first — it takes two minutes and tells you where you likely stand before you commit to anything.
Tell us a little about your business and we'll confirm your tier and fixed fee within one working day.
A short monthly briefing from the Kenya Privacy Law Review — new ODPC determinations, guidance notes, and compliance deadlines. No spam, unsubscribe anytime.