Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021

Regulation 4(1) requires every data controller and data processor to register in accordance with the Act and the Regulations. Regulation 13(2) exempts a data controller or data processor from mandatory registration where it has an annual turnover of below five million shillings or annual revenue of below five million shillings, and has less than ten employees.

Regulation 13(4) withholds that exemption from a data controller or data processor whose annual turnover is below five million shillings and which processes personal data for the purposes specified under the Third Schedule. The Third Schedule lists those purposes, among them gambling, operating an educational institution, health administration, the provision of financial services, telecommunications network or service providers, and businesses wholly or mainly in direct marketing.

Regulation 13(5) also states that the data controllers and data processors contemplated under subregulation (2) are required to undertake mandatory registration in accordance with Part III of the Act and the Regulations. A certificate of registration is valid for a period of twenty-four months from the date of issuance. A registered data controller or data processor must apply for a renewal of registration after the expiry of the certificate of registration.

A data controller or data processor must notify the Data Commissioner in writing within fourteen days of any change in its registered particulars. Processing personal data without registering, providing false or misleading information for registration, or failing to renew a certificate of registration and continuing to process personal data after it expires is an offence liable to the penalty specified under section 73 of the Act. Regulation 1(2) brings the Regulations into effect six months from the date of publication.