Health facility owners in Kenya have until March 31, 2025, to comply with privacy laws requiring them to register and obtain certification as data handlers and processors.
The Kenya Medical Practitioners and Dentists Council (KMPDC) announced that all newly established hospitals must secure certification from the Office of the Data Protection Commissioner (ODPC).
Starting January 1, 2025, all new health facility registrations must include a valid certificate of data handler/processor issued by the ODPC. Existing facilities must obtain this certification by the March 31 deadline, according to KMPDC chief executive David Kariuki.
“This requirement highlights the critical importance of safeguarding patient privacy, which is a core aspect of ethical medical practice. By ensuring the responsible handling of personal data, health institutions will not only meet regulatory standards but also build trust and enhance patient safety,” Kariuki explained.
This move to enforce data protection in healthcare comes as the ODPC intensifies its efforts to ensure compliance and prevent data breaches across various sectors. Under the Data Protection (General) Regulations 2021, the Data Protection (Complaints Handling and Enforcement Procedures) Regulations 2021, and the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021, all entities handling personal information must register as data processors and data controllers.
These regulations impact numerous sectors, including telecom companies, digital ride-hailing services, building managers, law firms, and financial service providers, among others.
Kenya’s Data Protection Act, effective since November 25, 2019, established guidelines for collecting, processing, and storing personal data by both public and private entities. The ODPC has handled numerous complaints, with 17 convictions resulting in Sh12 million in compensation for the complainants.
