Data Protection Commissioner Certifies 1,600 Processors and Controllers

Since the implementation of new regulations in March, the Office of the Data Protection Commissioner (ODPC) has issued compliance certificates to 1,623 data processors and controllers. This registration process began in mid-July of last year.

The new total represents a slight increase over the previous figure of 1,417 by the end of January this year, which amounted to 206 companies licensed in just two months.

As of September 2 of last year, 332 certificates had been issued, according to a previous report from ODPC.

Immaculate Kassait, the Data Protection Commissioner, introduced the Data Protection Registration System in January. This system allowed applicants the freedom to manage their own registrations and stated that certificates would be renewable every two years.

“The new registration system will be able to display the entire process of registration and everything will be completed online,” Kassait stated.

According to the legislation passed by Parliament, entities which handle the personal data of citizens in the country must register as data controllers or processors.

Data Protection (General) laws 2021, Data Protection (Complaints Handling and Enforcement Procedures) Regulations 2021, and Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021 are some of the laws that fall under this category.

Businesses discovered to have violated the rules may be subject to fines of up to Sh5 million or one percent of their annual turnover.

The legislative action was prompted by an increase in complaints about the absence of data security laws and the misuse of personal data, particularly by political parties, digital lenders, and human resources personnel.

The new legislative framework has as its targets telecom companies, property managers, CCTV operators, digital ride-hailing service providers, dispensaries, and educational institutions.

13 industries, including processors of genetic data like bars, restaurants, medical research companies, and healthcare laboratories, have been placed on Ms. Kassait’s radar for mandatory registration.