Sections 18-19 of the Kenya DPA establish the mandatory registration framework administered by the Office of the Data Protection Commissioner (ODPC). (1) Section 18 Mandatory Registration: (a) Every data controller AND data processor must be registered with ODPC before processing personal data; (b) Penalty for non-registration - administrative penalty + cessation of processing order; (c) ODPC maintains public register of registered controllers + processors; (d) Annual renewal required. (2) Registration Categories: (a) Public sector controllers - government ministries + counties + state corporations; (b) Private sector controllers - SMEs + large businesses + multinationals; (c) Processors - service providers + cloud providers + outsourcing partners; (d) Joint controllers; (e) Foreign entities processing Kenya data subjects. (3) Registration Application Content per Section 19: (a) Identity of controller/processor + contact details; (b) Categories of personal data processed; (c) Purposes for processing; (d) Categories of data subjects; (e) Categories of recipients; (f) Cross-border transfer destinations + safeguards; (g) Security measures (general description); (h) Retention periods; (i) DPO contact details where applicable; (j) Material change notification within 30 days. (4) Registration Fees + Categories: (a) Tiered fee structure based on entity size + sensitivity of processing; (b) Annual renewal fees; (c) Reduced fees for SMEs + non-profits; (d) Exemption fee considerations. (5) Public Register: (a) ODPC publishes registered controllers + processors; (b) Public access to verify registration status; (c) Transparency mechanism; (d) Search functionality. (6) Registration Exemptions per Section 18(2): (a) Personal/household activity by natural persons; (b) Processing for purposes of journalism + literary + artistic expression with public interest; (c) National security + criminal investigation processing (subject to safeguards); (d) Specific Ministerial exemptions; (e) Statistical + research processing (subject to anonymisation). (7) Material Change Notification: (a) Change in name + ownership + address; (b) Change in DPO; (c) Change in categories of processing; (d) Change in cross-border destinations; (e) 30-day notification window. (8) Failure to Register Consequences: (a) Administrative penalty up to KES 5 million OR 1 percent annual turnover; (b) Cessation of processing order; (c) Public Naming on ODPC website; (d) Criminal liability for material violations; (e) Cooperation with criminal investigations. (9) Cross-Sector Coordination: (a) Central Bank of Kenya + banking sector registration; (b) Insurance Regulatory Authority + insurance sector; (c) Communications Authority of Kenya + telecom sector; (d) Kenya Revenue Authority + tax compliance; (e) Health sector registration. (10) Compliance Strategy: (a) Register early + before processing begins; (b) Comprehensive Statement of Registration; (c) Annual renewal calendar; (d) Material change tracking process; (e) Customer service training on registration; (f) Vendor + processor registration verification. Coordinates with EU GDPR + Convention 108+ + ICCPR + Kenya Constitution Article 31 + Section 5 ODPC establishment + Section 6 ODPC + Section 18 + 19 + 51 + Communications Authority of Kenya + Central Bank of Kenya + Insurance Regulatory Authority + Kenya Revenue Authority. Kenya DPA Registration + Sections 18-19 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.