Only 1,600 entities have complied with new data laws – Business Daily
Data Protection Commissioner Immaculate Kassait. FILE PHOTO | NMG
Over 1,660 entities have registered with the Office of the Data Protection Commission (ODPC) as data processors and controllers.
This follows an ongoing registration process that kicked off on July 14, requiring all entities handling personal information of individuals residing in Kenya to register as data controllers or processors.
Some of the entities targeted include telecommunications firms, digital ride-hailing service providers, building managers and businesses operating CCTV, dispensaries, primary and secondary schools.
This comes amid increased complaints about the lack of data protection laws and abuse of personal, especially by digital lenders, political parties and human resource departments.
ODPC has said applications received are a wide range of entities including government agencies, non-profit entities, private organizations, religious institutions among others.
The registration will be done every two years and costs for registration range from Sh4,000 to Sh40,000.
“I urge all data controllers and processors to get registered in compliance with the regulations which seek to protect the right of individuals and facilitate the realization of a thriving digital economy which relies on data for innovation and growth,” said Data Protection Commissioner Ms Immaculate Kassait.
The regulations targeted all public and private entities that deal with personal data including non-governmental organizations (NGOs) and churches.
ODPC had marked 13 sectors for mandatory registration including bars, restaurants, processors of genetic data like medical research companies, and medical labs; private and public healthcare providers including clinics, mental healthcare centres and e-health providers.
Other entities include law firms, property managers, real estate agencies, and businesses providing financial services including mobile money agents, digital lenders and Saccos.
Organisations that have an annual turnover of less than Sh5 million or less than 10 employees were exempted from registration.
However, other smaller businesses and entities whose revenue and the number of staff fall below the exempted threshold will be required to register due to their position to collect and hold personal information.
As of September 2, the office had issued 332 entities with certificates of registration while 805 others were yet to make payment in order to proceed with the application process.
Another 459 entities are still in the registration stage while the registration of 64 other entities are under review.
The office is set to begin random inspections of public and private entities to evaluate the processing of personal data and storage.
ODPC will also list companies that have complied on their website for their customers to see after they have been granted the registration license.
