Data Handlers Given 14 Days to Renew Expired Certificates or Face Action

Data controllers and processors with expired registration certificates have 14 days to renew them or face possible enforcement action by the Office of the Data Protection Commissioner (ODPC).

ODPC has directed all affected entities to regularize their registration status by applying for renewal within 14 days from the date of its notice.

Organizations required to register as data controllers or data processors cannot continue operating in those capacities without valid registration, according to the commission.

Continued processing of personal data after a registration certificate expires without renewal also constitutes an offence under the relevant regulations.

Affected entities have been urged to complete the renewal process within the stipulated period to avoid possible action.

ODPC said failure to comply with the 14-day deadline may result in enforcement measures being taken in accordance with the law.

The notice applies to entities whose certificates have already expired and serves as a warning that processing personal information without valid registration could attract regulatory action.

Businesses and other organizations handling personal data are therefore expected to check their registration status and act within the period provided.

Registration Certificates Valid for 24 Months

Section 18 of the Data Protection Act, 2019 requires any entity that qualifies as a data controller or data processor to register with the Data Commissioner before acting in that capacity.

Also Read: OPINION: Why Kenya’s Data Protection Act is the New Gold Standard for SMEs

Under Regulations 9 and 11 of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, registration certificates are valid for 24 months and are subject to renewal.

Once a certificate expires, an entity cannot continue processing personal data in its capacity as a registered data controller or processor unless it has renewed its registration.

ODPC has reminded affected entities to use the 14-day window to bring their registration status up to date. Failure to do so could lead to enforcement action under the Data Protection Act and applicable regulations.

Entities seeking clarification or assistance have been directed to contact ODPC through registration@odpc.go.ke.

Additional information and support are available through the commission’s website, www.odpc.go.ke.

Also Read: Kenya’s Plan to Monetize Data Through New National Data Governance Law

Affected organizations should therefore act within the stated period rather than wait until enforcement proceedings begin.

Follow our WhatsApp channel for more updates

ODPC gives data handlers 14 days to renew expired registration certificates.Data Commissioner Immaculate Kassait, Head of ODPC Kenya. PHOTO/ ODPC X.