1 year ago
125 On August 5, reports emerged that the Kenyan Office of the Data Protection Commissioner (ODPC) has imposed stricter regulations on protecting consumer data, targeting startups and fintechs in the region.
The law is built on Kenya’s 2019 Data Protection Act and will need startups to register with the ODPC when processing all personal data. Parties can register as Data Processors or Data Controllers and are compelled to pay a fee for all in case they register both. Data Controllers are defined as those that choose and profit from the personal data being used, and Processors manage third-party data.
Financial services firms and entities fall under the organizations that are not exempt from mandatory registration irrespective of their yearly turnover or number of employees. Big tech and fintech startups mainly will be affected by the new law, as they will be needed to reveal the personal data they are processing, the purpose of collecting it, and the target audience that they collect it from.
The law needs that all the entities that process data need to register with the ODPC and pay fees based on the number of employees, turnover, revenue, and whether the company is a public entity or not.
The new law is similar to the EU’s GDPR, and companies will be needed to request consent from clients to use their data and inform them of all the reasons for data collection and storage.
This update underpins the importance of holding firms accountable for data collection and guaranteeing that consumers are protected at all times. To guarantee compliance, entities need to inform the ODPC of breaches in data within 72 hours otherwise they are at risk of facing jail time and fines.
Immaculate Kassait, Kenya’s Data Commissioner, commented:
“Registration is just one, but very important, element of compliance with the data protection legislation as entities, including individuals, cannot act as Data Controllers or Data Processors in Kenya unless they have registered with the ODPC.”
