If you have a clinic in Kenya, you must register with the Office of the Data Protection Commissioner (ODPC) as a data controller, whatever your size. You do it online on the ODPC data portal: create an account, describe the patient data you hold and how you protect it, upload your establishment documents and turnover evidence, then pay. The small-business exemption does not cover patient care, and the KMPDC asks for your ODPC certificate when you register a new health institution.
Registration is only the first duty. The same law governs how you take consent, how long you keep records, and what you do in the 72 hours after a breach. This guide covers all four, and what your patient system must do to keep up.
This article is general guidance, not legal advice. Check your own obligations with a qualified data protection lawyer or the ODPC.
Key Takeaways
- Register on the ODPC portal before anything else: health facilities cannot use the small-business exemption, and KMPDC lists the certificate as a required document for new institutions.
- Diary the renewal the day the certificate arrives. It lasts 24 months, and the ODPC asks you to apply to renew at least 30 days before expiry.
- Record consent to data processing separately from consent to treatment, because the burden of proving it sits with you.
- Write a retention schedule with a reason for each period. The Act sets no fixed period for clinic records, so “we keep everything” is not a defence.
- Choose a system with individual logins, role-based access and an audit trail, or you cannot write the breach report the ODPC expects inside 72 hours.
Does a small clinic in Kenya have to register with the ODPC?
Yes. Section 18 of the Data Protection Act 2019 says no person may act as a data controller or processor unless registered with the Data Commissioner. Health data counts as sensitive personal data under section 2.
The Registration Regulations 2021 exempt organisations with turnover below KSh 5 million and fewer than ten employees (regulation 13), but not those processing data for a purpose in the Third Schedule. Item 5 of that schedule is “Health administration and provision of patient care”, so a one-doctor clinic in Kitengela is covered exactly as an Upper Hill hospital is. The ODPC’s Guidance Note on the Processing of Health Data (December 2023) is blunt: “All entities involved in the healthcare sector must undergo mandatory registration.”
There is a licensing reason too. The KMPDC’s application form for a new health institution (Form XIII) lists a “Data controller certificate from the Office of the Data Protection Commissioner” among the attachments. Our view: treat ODPC registration as part of opening the clinic, filed with your premises and equipment documents, not as a task for later.
How does the ODPC portal registration work?
Every “Register” link on the ODPC website leads to dataportal.odpc.go.ke. At the time of writing, the form runs in this order:
- Pre-registration. First-time or resumed application, the applicant’s details, and whether you are a data controller or processor. A clinic is a controller.
- Category. Government, private, or not-for-profit and religious. Mission hospitals may fall under the third.
- Basic details. The clinic’s name exactly as on its registration certificate, address, county, sector, and your establishment document (PDF, 8MB maximum).
- Data Protection Officer. Optional.
- Personal data. Each group of data with its purpose. Keep patient, employee and supplier data separate.
- Sensitive personal data. Tick “health status” and give the purpose, plus anything else you hold, such as fingerprints from a biometric clock-in.
- Transfer of data. Whether any data sits outside Kenya, and in which countries. A vendor hosting abroad shows up here.
- Risk measures. Your technical, organisational and physical safeguards: encryption, access controls, policies, training, locked storage.
- Employees and turnover. Your turnover band (below KSh 5 million, KSh 5,000,001 to 50 million, or above 50 million) and staff range, with audited accounts (or KRA returns for a new entity) and a signed declaration of employee numbers.
- Review. Certify the information is true.
- Login. The email and password for your dashboard. One email serves one entity only, so two clinics need two addresses.
You then pay by M-Pesa, bank or cheque, choosing one method and generating one invoice. Portal support: registration@odpc.go.ke, +254 796 954 269 or +254 752 896 867.
Take section 8 seriously: regulation 10 lets the Commissioner decline an application where “appropriate safeguards” have not been provided. “We lock the door” will not do.
What does ODPC registration cost and how long does it take?
Fees are in the Second Schedule of the Registration Regulations and repeated in the ODPC FAQs.
| Category (Second Schedule) | Registration fee, once | Renewal every 2 years | What this means for you |
|---|---|---|---|
| Micro and small: 1 to 50 employees, turnover up to KSh 5 million | KSh 4,000 | KSh 2,000 | Most single-doctor clinics and small pharmacies |
| Medium: 51 to 99 employees, turnover KSh 5,000,001 to 50 million | KSh 16,000 | KSh 9,000 | A busy multi-department clinic or nursing home |
| Large: over 99 employees, turnover over KSh 50 million | KSh 40,000 | KSh 25,000 | Hospitals and lab chains |
| Public, charity and religious entities (any size) | KSh 4,000 | KSh 2,000 | County facilities and many mission hospitals |
Once the Commissioner is satisfied, the certificate issues within 14 days (regulation 8). A refusal comes in writing, with reasons, within 21 days of the decision (regulation 10). The certificate lasts 24 months (regulation 9), and any change in your particulars, such as a new address, must be reported in writing within 14 days (regulation 15).
Worked example: a clinic in Nakuru with 12 staff and last year’s turnover of KSh 4.2 million is micro and small. Over six years it pays KSh 4,000 to register plus two renewals: 4,000 + (2 x 2,000) = KSh 8,000. The fee is trivial. A lapsed certificate, which KMPDC will not accept and which leaves you in breach of section 18, is not.
What patient consent does the law require?
Clinics mix up two consents. Medical consent is agreement to treatment. Data protection consent is agreement to how data is collected, stored and shared. The ODPC guidance says medical consent “does not necessarily grant the right to share or store medical data for other purposes”.
Consent is not the only lawful basis; section 30 also allows processing necessary for a contract, a legal obligation or vital interests, among others. Where you rely on consent:
- You carry the proof. Section 32(1) puts the burden on the controller, and the ODPC says health entities must “keep a verifiable record of the consent”.
- Explain first. Regulation 4 of the General Regulations 2021 lists what to tell the patient: who you are, each purpose, the data used, any third parties, the right to withdraw and its effect. Written, oral, audio or video all count.
- Allow withdrawal. Section 32(2) of the Act and section 31(4) of the Digital Health Act 2023 both give patients this right.
- Minors and patients without capacity. A parent, guardian or next friend acts for them (Digital Health Act, section 32).
The Digital Health Act, in force since 2 November 2023, adds at section 31(1) that a healthcare provider “shall ensure that he or she has obtained consent to process sensitive personal data”, with exceptions for public health and statutory work. Section 29 of the Data Protection Act also requires you to tell patients why you collect their data, who receives it and how you protect it. In practice: one plain-language notice at reception and in any patient app, and a consent record against each file.
How long must a Kenyan clinic keep patient records?
The Data Protection Act gives no number. Section 39 says keep personal data only as long as reasonably necessary for its purpose, unless the law requires longer, the patient consents, or another listed reason applies. Then “delete, erase, anonymise or pseudonymise” it.
Regulation 19 of the General Regulations requires a written retention schedule stating the purpose of retention, the period, a periodic audit, and the action after each audit. The ODPC guidance confirms the Act “neither stipulates nor defines any particular retention times” and warns against keeping data “on a ‘just-in-case’ basis”. Its example provider keeps records of non-returning or deceased patients for seven years, then destroys or anonymises them. That is an illustration, not a legal minimum.
The Digital Health Act’s twenty-year minimum in section 25 gets misquoted. On its wording it covers “data held in the system”, meaning the national Comprehensive Integrated Health Information System run by the Digital Health Agency (section 15), not your clinic’s own files. Check any professional rule for your facility type, write down your period and the reason, and make sure your software can apply it.
What must a clinic do after a patient data breach?
Section 43 applies where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm. You must notify the Data Commissioner “without delay, within seventy-two hours of becoming aware”, and tell affected patients in writing within a reasonably practical period. A late notice must give reasons for the delay.
For clinics, the risk test is often settled in advance. Regulation 37 deems a breach to carry real risk of harm when it involves data in the General Regulations’ Second Schedule, which includes diagnosis or treatment of sexually transmitted diseases, HIV, mental disorder and substance abuse, as well as contraceptive procedures, abortion and organ donation. A leaked HIV clinic register is notifiable, full stop.
Regulation 38 sets the contents of your notice, including when you found out, a chronological account of your steps, how many people were affected, which data, and the likely harm. If a vendor runs your system, section 43(3) requires it to tell you without delay, and where reasonably practicable within 48 hours.
Separately, Digital Health Act section 35 makes tampering with, losing, stealing or wrongly sharing health data a criminal offence, with a fine of up to KSh 1 million, up to 15 years’ imprisonment, or both.
On fines: section 63 caps an ODPC penalty at KSh 5 million, “or in the case of an undertaking, up to one per centum of its annual turnover of the preceding financial year, whichever is lower”. On that plain wording, a clinic turning over KSh 40 million faces a cap of 40,000,000 x 0.01 = KSh 400,000. Do not relax. Section 65 lets a patient who suffers damage claim compensation on top, and the Digital Health Act offences are criminal.
What must a patient management system do to comply?
Neither Act names products, but regulation 32 of the General Regulations spells out the security elements, including “ensuring only authorised personnel have access”, backups and logs, “audit trails and event monitoring as a routine security control”, and keeping sensitive data separate “where possible”. Digital Health Act section 33 adds that you must verify the identity and authority of anyone using sensitive data.
| Legal source | What the system must do | What this means for you if it is missing |
|---|---|---|
| DPA s.41, reg 32 | Individual logins and role-based permissions | With a shared password you cannot show who opened a record |
| Reg 32 | Audit trail of every view, edit and export | You cannot build the regulation 38 timeline in 72 hours |
| DPA s.41(4) | Encryption, and quick restore after an incident | A stolen laptop becomes a notifiable breach |
| DPA s.39, reg 19 | Retention periods by record type, then deletion or anonymisation | Old records pile up, and so does your exposure |
| DPA s.29 and s.32 | Privacy notice and consent captured at registration, withdrawals logged | No evidence when a patient complains |
| DHA s.38 | Identity checks before releasing records | Results reach the wrong relative |
Hosting location is a legal question. Regulation 26 requires anyone processing data for “provision of primary or secondary health care for a data subject in the country” to use a server and data centre in Kenya, or keep at least one serving copy in a Kenyan data centre. Section 49 adds that sensitive data may be processed outside Kenya only with the patient’s consent and confirmed safeguards. Ask every vendor where the data and backups sit, and put the answer in the contract.
That contract is mandatory anyway. Section 42(2) and regulation 24 require a written agreement with any processor covering the processing, your instructions, confidentiality, security, deletion or return at the end, and your right to audit. The ODPC names electronic health record and hospital management system vendors as typical processors. If a vendor cannot show you a data processing agreement, keep looking. Our buyer’s guide to clinic management systems and hospital management system prices help with the comparison.
Worked example: a Kisumu clinic with 14 staff (four clinicians, three receptionists, two billing clerks, two lab technicians, three support staff) shares one login, so all 14 can read every consultation note. With five roles, only the four clinicians see full notes: (14 - 4) / 14 = 10 / 14 = 71% fewer people with access to a diagnosis, and a leak complaint now points to named users and timestamps. The caveat: it fails if clinicians leave sessions open on shared computers, so screen locks matter as much as the software.
Your compliance plan for this week
- Register or check your certificate. Start on the ODPC portal, or find your certificate and note its expiry.
- List where patient data lives. Records system, lab machines, billing, staff WhatsApp, email, paper files, backups. Portal sections 5 to 8 need this list anyway.
- Map roles to data and switch off every field a role does not need.
- End shared logins. Individual accounts, and two-factor login for administrators.
- Test the audit trail. Open a test record and find your own access in the log.
- Write a one-page breach plan. Who decides, who notifies the ODPC, who writes to patients, and the regulation 38 checklist. The clock starts on awareness, not when the investigation ends.
- Draft your retention schedule in the regulation 19 format.
- Ask your vendor for a data processing agreement and the physical location of your data.
- Put a privacy notice at reception and record consent against each file.
Steps 7 to 9 deserve a lawyer’s review. Adding AI tools? Our guide to AI and compliance in Kenya covers the extra questions, and automated appointment reminders shows how to message patients without exposing records.
Mistakes to avoid
Assuming you are too small to register. The exemption does not apply to patient care.
Letting the certificate lapse. It lasts 24 months.
Treating treatment consent as data consent. Record both.
Sending results from personal WhatsApp. A lost phone can become a notifiable breach with no record of what was on it.
Assuming the vendor carries the risk. You are the controller, so the 72-hour notice is your duty even when the vendor was breached.
Choosing foreign hosting without checking regulation 26 and section 49.
Frequently asked questions
What is the ODPC portal?
It is the ODPC’s online system at dataportal.odpc.go.ke, where organisations register as data controllers or processors, pay the fee, track the application and download the certificate. All registration links on the ODPC website point to it.
I have a clinic with fewer than ten staff. Do I still need to register?
Yes. The exemption for organisations under KSh 5 million turnover and fewer than ten employees does not apply to “health administration and provision of patient care”, which is in the Third Schedule of the Registration Regulations. Expect the micro and small fee of KSh 4,000.
Do I register as a data controller or a data processor?
A clinic decides why and how patient data is used, so it is a controller. If you also process data for another organisation under contract, the ODPC FAQs say acting as both needs two applications and two fees.
Can my patient system be hosted outside Kenya?
Not freely. Regulation 26 requires health care data to be processed through a Kenyan data centre, or at least one serving copy to sit in Kenya, and section 49 requires patient consent and safeguards for sensitive data processed abroad. Take advice before choosing a foreign-hosted product; our guide to cloud hosting options in Kenya compares providers.
Must every breach be reported to the ODPC?
Section 43 covers unauthorised access with a real risk of harm, and regulation 37 deems many health breaches to meet that test, including anything touching HIV, sexually transmitted disease, mental health or addiction treatment. If in doubt, prepare the notice within 72 hours and take advice in parallel.
Does the Digital Health Act replace the Data Protection Act?
No. It adds health-specific duties on consent, security, disclosure and e-health, but its section 61 says anyone processing personal data under it “shall comply with the Data Protection Act”. You must meet both.
Where to start if your clinic is still on paper
Register first, because everything else assumes you have. Then list where patient data lives, write the breach plan, and choose a system with individual logins, an audit trail, retention settings and Kenyan hosting from day one. A good system turns most of this law into routine; a shared password and a spreadsheet make it close to impossible.
If you want a second opinion before choosing software, our free AI Business Assessment is a sensible first step, and we quote in writing only after we understand how your clinic works. If you would rather talk it through, WhatsApp us on 0711 344 702.