By the NGOs.ke Editorial Team.
Does your NGO have to register with Kenya’s Data Protection Commissioner? In almost every case, yes. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 make charities and religious entities register regardless of revenue, at a one-time fee of Sh4,000 and Sh2,000 to renew every two years. The only way out is the small-entity exemption: annual turnover under Sh5 million and fewer than 10 employees. Processing personal data without a certificate is an offence under the regulations.
Key facts for NGOs at a glance
| Item | What the regulations and the ODPC say |
|---|---|
| Who must register | Data controllers and processors; charities and religious entities regardless of revenue |
| Registration fee (charity) | Sh4,000 one-time |
| Renewal fee (charity) | Sh2,000 every two years |
| Certificate validity | 24 months from issue |
| Renewal timing | Apply at least 30 days before expiry |
| Exemption | Turnover below Sh5 million AND fewer than 10 employees (meeting only one does not count) |
| Extra payment charge | Sh50 on mobile money and card payments; none on bank transfers or cheques |
Why does this matter for NGOs in particular?
NGOs hold the kind of data regulators worry about: beneficiary lists, health and protection case files, refugee registration details, donor records, staff and volunteer files. A programme that photographs children, collects phone numbers for cash transfers or runs a hotline is processing personal data every day. Under the Data Protection Act, 2019, that makes the organisation a data controller, and often a processor too when it handles data on behalf of a donor or partner.
What did the ODPC announce in August 2026?
On 29 August 2026, Capital FM reported that the Office of the Data Protection Commissioner (ODPC) had given organisations on its published list of expired certificates 14 days, until close of business on 11 September 2026, to renew through the ODPC portal. The notice warned of enforcement action, and the regulations make it an offence to keep processing personal data after a certificate lapses. If your NGO registered in 2022 or 2024, check your certificate date now; a two-year cycle means many first-wave registrations are due or overdue.
How much does registration cost for a PBO?
The Second Schedule to the 2021 Regulations sets the fees. Charities pay the same low rate as small entities and public bodies, whatever their budget. Entities that do not qualify as charities pay by size:
- Micro and small (up to Sh5 million turnover, 1 to 50 employees): Sh4,000 to register, Sh2,000 to renew.
- Medium (Sh5 million to Sh50 million, 51 to 99 employees): Sh16,000 and Sh9,000.
- Large (above Sh50 million, over 99 employees): Sh40,000 and Sh25,000.
- Charities and religious entities: Sh4,000 and Sh2,000.
If a PBO also acts as both controller and processor for the same processing, the regulations say it pays the fees for both.
Can a small community NGO claim the exemption?
Possibly, but be careful. Regulation 13 exempts an entity only if annual turnover is below Sh5 million and it has fewer than 10 employees. Even then, the exemption disappears if you process data for certain listed purposes, including health administration and patient care, operating an educational institution, financial services, and canvassing political support. A community clinic or school-linked project therefore cannot rely on it. And exempt organisations must still comply with the substantive parts of the Act, so being exempt from the certificate does not mean being exempt from the rules. When in doubt, register: Sh4,000 is a small price compared with a donor audit finding.
What should an NGO do this month?
- Map what personal data you hold, where it sits and who can see it.
- Check your certificate expiry date, and diarise the renewal for 30 days earlier.
- Register or renew on the ODPC portal and keep the certificate with your compliance file.
- Update your privacy notice and consent forms, especially for photos and minors.
- Write data protection into your safeguarding approach, as our safeguarding policy guide explains for child protection.
- Review the tools you use; our guide to free technology for Kenyan NGOs and digital fundraising tools both involve donor and beneficiary data.
Registration also sits alongside your wider filing duties; see our PBO annual returns guide. The official guidance and portal are on the ODPC website.
Frequently asked questions
How long is an ODPC registration certificate valid?
Twenty-four months from the date of issue, unless the Data Commissioner cancels it. Renewal applications are due at least 30 days before expiry.
What is the ODPC registration fee for an NGO?
Sh4,000 one-time for charities, and Sh2,000 to renew. Mobile money and card payments add a Sh50 transaction charge.
Is it an offence to process data without registering?
Yes. The regulations list processing without registering, giving false information, and continuing after a certificate expires as offences, with the penalty set by section 73 of the Data Protection Act.
Does a small NGO need to register?
Only if it fails the exemption test. It must have turnover below Sh5 million and fewer than 10 employees, and must not process data for a listed purpose such as health care.
Do we need to register if a donor holds the data?
If your staff collect, store or use the personal data, you are likely a controller or processor. Confirm roles in your grant agreement and, if unsure, take legal advice.
This guide is general information as of October 2026, not legal advice. Confirm current fees and requirements with the ODPC.
Leave your comment