[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-289391-105":59,"doc-detail-289391-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","data-controllers-360-degrees-compliance-requirements-z-card","Data-Controllers-360-Degrees-Compliance-Requirements-Z-Card","","Pre-registration and ongoing compliance requirements outline when registration is mandatory, including thresholds for employees and turnover, and exclusions covering activities such as political canvassing, gambling, certain education and health operations, processing genetic data, and specified service sectors. Guidance covers supporting statutory documents, registration steps via the ODPC portal, cross-border transfer conditions, DPIA triggers for high-risk processing, and document preparation in PDF or JPEG formats.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/data-controllers-360-degrees-compliance-requirements-z-card/289391/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/data-controllers-360-degrees-compliance-requirements-z-card/289391.png","ImageObject",300,407,{"name":92,"@type":93},"Ivy","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-09","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":19},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"When is registration mandatory for data controllers?","Question",{"text":112,"@type":113},"Registration is mandatory for medium or large businesses meeting employee or turnover thresholds, and for public entities/non-profits including NGOs and religious organizations.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"What types of cross-border data transfers are allowed?",{"text":117,"@type":113},"Transfers outside Kenya are allowed only when explicit consent is obtained for sensitive data, appropriate safeguards are implemented (including ODPC-approved measures like Binding Corporate Rules or Standard Contractual Clauses), and necessity is demonstrated with no local alternatives and critical service delivery needs.",{"name":119,"@type":110,"acceptedAnswer":120},"What activities typically require a DPIA?",{"text":121,"@type":113},"A DPIA is required for high-risk activities such as automated decision-making with significant effect, large-scale processing for different purposes, processing biometric or genetic data, changes increasing risk, processing sensitive data or data about vulnerable groups, and large-scale systematic monitoring of publicly accessible areas.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},289391,1792028671,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":19,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":14,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":143,"read_time":24,"preview_page_count":4},549758252649,"https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819","Pre-Registration Checklist  \nBefore beginning yourODPC registration, verify these essentials  \nRegistration is mandatory if:  \n▪ Your business is medium/large:  \n• Ten or more employees, or  \n• Annual turnover of Ksh 5 million or above  \n▪ You are a public entity/non-profit (including NGOs and religious organizations)  \nSupporting Documentation  \nApplicants to provide statutory documents to verify employee numbers and annual turnover:  \n• A signed declaration from the entity on the number of employees.  \n• For annual turnover: Audited financial statements or KRA tax returns  \n• Establishment documents e.g. Certificate of Incorporation, Certificate from Registrar of Societies, Gazette Notice, Act of Parliament.  \nThe following are not exempted regardless of turnover or number of employees:  \n▪ Canvassing political support among the electorate.  \n▪ Gambling.  \n▪ Crime prevention and prosecution of offenders (including operating security CCTV systems)  \n▪ Operating an Educational Institution  \n▪ Health administration and provision of patient care.  \n▪ Businesses that process  \ngenetic data.  \n▪ Hospitality industry firms but excludes tour guides  \n▪ Property management including the selling of land  \n▪ Provision of Financial services  \n▪ Telecommunication network or service providers  \n▪ Direct marketing  \n▪ Transport service firms  \nImportant Notice  \n• The Data Commissioner reserves the right to verify submitted information with relevant institutions.  \n• False declarations may result in revoked registration and fines under Section 65.  \nRegistration PROCESS  \n• Track status via yourODPC portal account.  \n• Print your certificate online once approved.  \nCross-Border Data Transfers  \nOrganizations may only transfer personal data outside Kenya when:  \nExplicit consent has been obtained (for health, biometric, or other sensitive data)  \nAppropriate safeguards are implemented,  \nincluding ODPC-approved safeguards:  \n• Binding Corporate Rules  \n• Standard Contractual Clauses (2023 Edition)  \nNecessity demonstration:  \n• No local alternatives exist  \n• Critical for service delivery  \nData Protection ImpactAssessments (DPIAs)  \nHigh-Risk Activities Requiring DPIAs:  \n▪ Automated decision making with legal or similar significant effect.  \n▪ Use of personal data on a large scale for a different purpose.  \n▪ Processing of biometric or genetic data.  \n▪ Change in any aspect of processing that may result in higher risk to thedata subject.  \n▪ Processing of sensitive personal data or data relating to vulnerablegroups.  \n▪ Combining, linking or cross-referencing separate datasets where thedata sets are combined from different sources and where processing iscarried out for different purposes.  \n▪ Large scale processing of personal data.  \n▪ Systematic monitoring of a publicly accessible area on a large scale.  \n▪ Innovative use or application of new technologies or organizationsolutions.  \n▪ Processing prevents the data subject from exercising their rights.  \nDOCUMENT PREPARATION  \nGather the following digital copies (in PDF or JPEG format) for submission:  \nBusiness Verification Documents  \n▪ Certificate of incorporation or business registration  \n▪ KRA PIN certificate  \nData Processing Information  \n▪ List of personal data categories collected (e.g., IDs, health records)  \n▪ Description of processing purposes (e.g., payroll administration, customer marketing)  \nHow to Maintain Compliance Designate a Data Protection Officer (OPTIONAL)  \nRegistration FEE  \nThe registration fees, valid for two years, are as follows:  \n\n| Organization Category | Registration | Renewal |\n| --- | --- | --- |\n| Micro and Small Entities | KSh. 4,000 | KSh. 2,000 |\n| Medium | KSh. 16,000 | KSh. 9,000 |\n| Large | KSh. 40,000 | KSh. 25,000 |\n| Public Institutions | KSh. 4,000 | KSh. 2,000 |\n| Charities & Religious Institutions | KSh. 4,000 | KSh. 2,000 |\n\nData Mapping and Record Keeping  \nMaintain detailed records of all personal data processing activities  \nDocument ","cbCaigVPmYY7xeuu","https://ap.wps.com/l/cbCaigVPmYY7xeuu","pdf",1708868,"English","# Pre-Registration Checklist\n## Supporting Documentation and Exemptions\n## Important Notice\n# Registration Process and Cross-Border Transfers\n## Registration Process\n## Cross-Border Data Transfers\n# Data Protection Impact Assessments (DPIAs)\n## High-Risk Activities Requiring DPIAs\n# Document Preparation and Registration Fee\n## Business Verification Documents\n## Data Processing Information\n## Registration Fee\n# Compliance Operations\n## Data Mapping and Record Keeping\n## Breach Management Protocol\n## Post Registration Requirements","[{\"question\":\"When is registration mandatory for data controllers?\",\"answer\":\"Registration is mandatory for medium or large businesses meeting employee or turnover thresholds, and for public entities/non-profits including NGOs and religious organizations.\"},{\"question\":\"What types of cross-border data transfers are allowed?\",\"answer\":\"Transfers outside Kenya are allowed only when explicit consent is obtained for sensitive data, appropriate safeguards are implemented (including ODPC-approved measures like Binding Corporate Rules or Standard Contractual Clauses), and necessity is demonstrated with no local alternatives and critical service delivery needs.\"},{\"question\":\"What activities typically require a DPIA?\",\"answer\":\"A DPIA is required for high-risk activities such as automated decision-making with significant effect, large-scale processing for different purposes, processing biometric or genetic data, changes increasing risk, processing sensitive data or data about vulnerable groups, and large-scale systematic monitoring of publicly accessible areas.\"}]","Data-Controllers-360-Degrees-Compliance-Requirements-Z-Card | PDF",1789635106]