Last week, the ODPC announced the commencement of the registration exercise for Data Controllers and Data Processors.
We have since covered what constitutes a data controller and data processor, and which firms/companies qualify for registration, as well as exemptions.
However, how much money do these companies need to pay for them to register? How long do the offered licenses last?
Well, according to the ODPC, registration charges are dependent on the category within which the data controller pr data processor falls.
The regulations classify profit-making or private data controllers and data processors for the purposes of the exercise into three classes.
There are micro and small data controllers/processors, meaning those with an annual turnover/revenue of KES 5 million and 1 to 50 employees.
The second tier is named medium data controllers/processors, which are companies with an annual turnover/revenue of above KES 5 million but less than KES 50 million and 51 to 99 employees.
Large data controllers and processors are those with an annual turnover/revenue of more than KES 50 million and more than 99 employees.
To note, public entities and non-profit making entities such as charities, and religious entities (regardless of revenue/turnover) are also required to register.
Here are the charges:
| Category | Renewal fees in KES per data controller/processor, payable once |
| Micro and small data controllers/vendors | 2000 |
| Medium data controllers/processors | 9000 |
| Large data controllers and processors | 25000 |
| Public entities that offer government services | 2000 |
| Charities and religious entities | 2000 |
