Kenya’s Office of the Data Protection Commissioner (ODPC) has issued a 14-day ultimatum to data handlers whose registration certificates have lapsed, according to a report by the-star.co.ke. The directive, published on Friday, August 28, 2026, requires affected organizations and individuals to renew their credentials within the two-week window or face unspecified consequences.
The notice applies broadly to all entities that process personal data and hold certificates that are no longer valid. The ODPC’s move signals a tightening of enforcement around Kenya’s data protection regime, which has been in effect since the Data Protection Act came into force. The regulator has previously warned about compliance gaps, but this deadline marks a concrete step toward clearing the backlog of expired certifications.
The-star.co.ke did not specify what penalties await those who miss the deadline, nor did it list the exact number of affected data handlers. The report also did not clarify whether the renewal process can be completed online or requires physical submission. What is clear is that the ODPC is pushing for immediate action, giving no indication of extensions or grace periods beyond the stated 14 days.
For data handlers, the clock starts now. The next development to watch is whether the ODPC follows through with enforcement actions or publishes a list of non-compliant entities when the deadline lapses.
