Data Commissioner registration for Kenyan schools

Why a small Kenyan school or college cannot rely on the Data Commissioner's small-entity exemption, and what it must register, renew and report.

By Achekam · 11 October 2026 · 5 min read · For Education businesses in Kenya

The director of a small private primary school in Kisumu hears that the Office of the Data Protection Commissioner exempts small businesses from registration. The school has a handful of staff and modest fee income. It seems safe to assume the rule is for bigger organisations.

For a school, that assumption is wrong. Kenya's registration regulations take education out of the small-entity exemption altogether, however small the school is. This article sets out what the Data Protection Act and its registration regulations say, as published on Kenya Law, and what a school or college has to do about registration, renewal and breaches.

The rule: register before you process

The Data Protection Act says no person may act as a data controller or data processor unless registered with the Data Commissioner, subject to thresholds for mandatory registration set by the Data Commissioner. That is section 18 of the Act, in the consolidated version on Kenya Law dated 31 December 2022.

A school is a data controller in the ordinary sense. It decides what personal data to collect about learners and their families: names, dates of birth, addresses, medical notes, fee payment records, photographs, guardians' phone numbers. Staff records add more. The question is not whether the school processes personal data; it plainly does. The question is whether it falls under a threshold that excuses it from registering.

The small-entity exemption, and why schools are outside it

The Data Protection (Registration of Data Controllers and Data Processors) Regulations exempt from mandatory registration a controller or processor with an annual turnover or revenue below five million shillings and fewer than ten employees. That is regulation 13, again in the consolidated version on Kenya Law. Even exempt entities must still comply with Parts IV and VI of the Act.

But the regulations then list purposes for which the exemption does not apply. The Third Schedule names, among others, processing personal data for education, health care, hospitality, property management, financial services, telecoms, direct marketing, transport including ride hailing, gambling, CCTV security and genetic data.

Education is on that list. A nursery, a primary school, a secondary school, a tuition centre or a college processing learners' personal data for education cannot rely on the small-entity exemption, whatever its turnover or staff numbers. Kenya Law publishes the registration regulations in full, including the exemption, the schedule of purposes it excludes and the fees.

Fees and renewal, at the time of writing

For micro and small data controllers or processors, described in the regulations as having 1 to 50 employees and turnover up to Kshs 5 Million, the Second Schedule sets:

The same amounts apply to public entities and to charities or religious entities, which matters for mission schools and community schools. Larger schools fall into other bands in the same schedule. Fees can change, so confirm them with the Office of the Data Protection Commissioner before applying.

Applying, renewing, and the cost of letting it lapse

The regulations require registration applications on Form DPR1 with the scheduled fee, and renewal applications after the certificate expires. They also make it an offence, citing section 73 of the Act, to continue processing personal data after the certificate expires without renewing it.

For a school, "processing" never stops. Fees are invoiced, attendance is recorded and report cards are written every term. A lapsed certificate is not a paperwork gap the school can leave until the holidays. Put the expiry date in the school's compliance calendar with a reminder well ahead of it, and assign the renewal to a named person.

Breaches: seventy-two hours, and a record of every one

The Act requires a data controller to notify the Data Commissioner of a personal data breach that poses a real risk of harm without delay, within seventy-two hours of becoming aware of it, and to give reasons if notification comes later. The controller must also tell affected data subjects in writing within a reasonably practical period, subject to exceptions set out in section 43.

Separately, the Act requires a data controller to record the facts of every personal data breach, its effects and the remedial action taken. That applies to every breach, not only those reported.

School breaches can be very ordinary: a class list e-mailed to the wrong parents' group, a staff laptop with learner records left in a taxi, a fee statement sent to the wrong family. Prepare before it happens:

1. Name the person who decides whether a breach poses a real risk of harm.
2. Keep a breach register with date discovered, what happened, whose data, effects and action taken.
3. Write a short notification template, so the seventy-two hours are not spent drafting.
4. Brief staff that every suspected breach is reported to that person the same day.

Limiting who opens learners' records and how they are shared

Registration is a legal step; the daily work is controlling who sees what. In Achekam, a school's documents can sit in Document Centre, a folder-based store where you upload files or whole folders, then preview, download, rename, move, tag, archive and search them, with each new version keeping the earlier ones. Keep learner and family documents, such as signed fee agreements or bursary applications, in their own folders rather than in shared inboxes.

When a document must leave the school, for example a fee statement to a parent's lawyer, it can be shared by e-mailing a personal link with an expiry, an optional one-time code, and download allowed or not, and the share can be revoked. Unlike an attachment, a link can be withdrawn once it has served its purpose.

Users can also turn on two-factor sign-in with an authenticator app, and the workspace can require it for every member under Settings, Security & SSO. A school should require it for everyone who can open learners' or families' records. Collecting fees through M-Pesa is covered in school fees through an M-Pesa paybill, and setting up the school's workspace in setting up a Nigerian or Kenyan business workspace.

This week, check whether the school holds a current registration certificate, note its expiry date, and open a breach register even if its first page stays empty.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.