Data Protection Act

18. Registration of data controllers and data processors

Edition: 2022-12-31 · In force

18. Registration of data controllers and data processors

(1)Subject to subsection (2), no person shall act as a data controller or data processor unless registered with the Data Commissioner.

(2)The Data Commissioner shall prescribe thresholds required for mandatory registration of data controllers and data processors, and in making such determination, the Data Commissioner shall consider—

(a)the nature of industry;

(b)the volumes of data processed;

(c)whether sensitive personal data is being processed; and

(d)any other criteria the Data Commissioner may specify.

← Previous provision Next provision →

Source: Kenya Law