ODPC gives data handlers 14 days to renew expired certificates

Jukwaa

📻 Breaking It Down

Data Commissioner Immaculate Kassait said all data controllers and data processors whose certificates have expired must regularise their status by September 11, 2026, close of business.

The directive is part of a renewed push by the data protection regulator to ensure organisations collecting, storing or processing personal information comply with Kenya’s data protection laws.

The ODPC, in a notice issued on Friday, reminded affected entities to apply for renewal without delay, warning that failure to comply within the 14-day window could trigger enforcement measures.

📌 What You Need to Know

The notice applies to organisations whose names appear on the regulator’s published list of entities with expired registration certificates.

Under the Data Protection Act, 2019, organisations that fall within the mandatory registration requirements cannot act as data controllers or data processors without registration with the Data Commissioner. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 provide that registration certificates are valid for 24 months and must be renewed.

The regulations go further by making it an offence for a data controller or processor to continue processing personal data after its certificate has expired without renewal.

The latest warning therefore places organisations with lapsed certificates on notice that continued handling of personal information without regularising their status could expose them to regulatory action.

The renewal fees vary according to the size and category of the organisation.

Micro and small data controllers and processors pay Sh2,000 for renewal, while medium-sized entities pay Sh9,000. Large entities pay Sh25,000, while public entities, charities and religious organisations pay Sh2,000.

📰 Source: Capital FM Kenya

0 0