ODPC Gives Data Controllers and Processors 14 Days to Renew Expired Registration Certificates
Affected organisations must regularise their registration status by 11 September 2026 or risk enforcement action
Technology Media & Communications | Data Protection
The Office of the Data Protection Commissioner (ODPC) has issued a 14-day notice to data controllers and data processors whose registration certificates have expired, requiring them to apply for renewal and regularise their registration status.
The notice, issued on 28 August 2026, is particularly significant for organisations that continue to process personal data in Kenya. Affected organisations should urgently verify their registration status and, where applicable, commence the renewal process.
Registration of Data Controllers and Data Processors in Kenya
Under section 18 of the Data Protection Act, 2019, a person may not act as a data controller or data processor unless registered with the Data Commissioner, subject to the applicable registration thresholds.
The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 further provide that a data controller or data processor that fails to renew its registration and continues processing personal data after expiry of its certificate commits an offence. Registration certificates are generally valid for 24 months, with the ODPC advising data controllers and processors to apply for renewal at least 30 days before expiry.
What Does the ODPC Notice Require?
The ODPC has directed organisations whose certificates have expired to regularise their registration status within 14 days from the date of the notice by applying for renewal. The notice applies specifically to entities whose registration certificates have already expired. The ODPC has also published a list of affected organisations, which businesses should review to determine whether their registration status requires immediate action.
The 14-day period runs from 28 August 2026, with the deadline falling on 11 September 2026. Organisations that fail to comply within the stipulated period may face enforcement action in accordance with the law.
Immediate Compliance Actions for Businesses
Organisations processing personal data in Kenya should consider taking the following steps:
- Verify their registration status on the ODPC's published list of expired data handler certificates;
- determine whether they are required to be registered as a data controller, data processor or both;
- where the certificate has expired, submit a renewal application without delay;
- review the information previously submitted to the ODPC and ensure that it remains accurate and complete; and
- maintain evidence of the renewal application and subsequent registration for compliance purposes.
The ODPC's registration process is conducted electronically through its registration portal. The portal requires applicants to provide information relating to, among other matters, their establishment, personal data processing activities, safeguards and security measures.
What Are the Risks of Continuing to Process Personal Data Without Valid Registration?
The ODPC's notice reinforces that organisations required to register should not continue operating as data controllers or processors without valid registration. Regulation 18 of the 2021 Regulations expressly identifies continued processing of personal data after expiry of a registration certificate, without renewal, as an offence.
The notice therefore signals a renewed focus on registration compliance and regulatory enforcement. Organisations should not treat registration as a one-off exercise but should incorporate certificate expiry and renewal into their broader data protection compliance framework.
Conclusion
The ODPC's 14-day notice provides a limited window for affected organisations to regularise their registration status. Businesses and other organisations that process personal data should check their registration status immediately and take appropriate steps to renew any expired certificates before the 11 September 2026 deadline.
The development is also a timely reminder that maintaining valid registration is an ongoing component of data protection compliance in Kenya, alongside compliance with the wider obligations imposed by the Data Protection Act and its subsidiary legislation.
Affected organisations can check the ODPC's list of expired registration certificates and commence the renewal process through the ODPC's online registration platform.
Useful Links
This alert serves the purpose of general guidance and is not intended to constitute specific legal advice. For advice on data protection compliance or assistance with registration and renewal, please contact our Partner & Head of Data Privacy, [email protected].
