Must a betting operator register with the ODPC?

Yes. The Third Schedule to the 2021 registration regulations lists gambling among the purposes for which a data controller must register with the Office of the Data Protection Commissioner, and the size exemption does not apply to it. The gambling licensing forms also ask for a data protection certificate.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-26

The short answer

A betting operator that processes personal data in Kenya must register with the Office of the Data Protection Commissioner (ODPC). The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 make registration the rule for every controller and processor (r.4(1)), and they name gambling in a schedule of purposes that must always register.

The operator is the data controller and you are the data subject, as the guide on personal data terms for gambling accounts explains. This guide reads the registration regulations, not the Data Protection Act itself, so section 18 and section 73 of that Act are mentioned only where the regulations point to them.

What the registration regulations say

The regulations provide the procedure for registration of controllers and processors under section 18 of the Act (r.3(1)). Subject to the exemption in regulation 13, every controller and processor must register (r.4(1)). A person registers as a controller where it determines the purpose and means of processing personal data (r.4(2)(a)).

A licensed online operator decides why and how account, identity and payment data is used, so it fits that description. A company that only processes data for the operator under contract, with no decision-making power over purpose and means, registers as a processor (r.4(2)(b)). A processor that handles data other than as instructed is treated as a controller for that activity (r.4(4)).

Why the size exemption does not help a gambling operator

Regulation 13(2) exempts a controller or processor that has an annual turnover or revenue below five million shillings and fewer than ten employees. Regulation 13(4) then removes that exemption for anyone processing personal data for the purposes in the Third Schedule, which is headed "Thresholds for mandatory registration". Item 3 of that Schedule is "Gambling".

How the gambling rules connect to registration

The gambling law treats the ODPC certificate as part of becoming a licensee. Before commencing operations, a licensee must show that it has obtained a data protection certificate from the Office of the Data Commissioner (Conduct of Gambling Operations Regulations, r.3(3)(r)). The online gambling licence application form (Form 8) lists a data protection certificate among the documents to attach.

Registration is the first layer only. The Gambling Control Act requires an online operator's approved gambling control system to include data protection measures under the Data Protection Act (s.68(2)(h)), and the conduct regulations require data collection and processing during gambling operations to comply with that Act (r.96(1)). The gambling control system guide shows where this sits among the operator's other duties.

What registration involves

An application is made on Form DPR1 with the fee in the Second Schedule, and it is submitted through the electronic means on the ODPC website (rr.5(1) and 17). It must come with the establishment documents, the particulars and contact details, a description of the purpose of processing and a description of the categories of personal data processed (r.5(2)). The form also asks about sensitive data, transfers outside Kenya, safeguards, staff numbers and previous-year turnover.

The Commissioner verifies the details (r.7) and, if satisfied, issues a certificate and enters the particulars in the register within fourteen days (r.8). Refusal must be notified in writing, with reasons, within twenty-one days (r.10(1)). After issue, a controller must tell the Commissioner in writing of any change in its particulars within fourteen days (r.15(1)).

Fees in the Second Schedule

Fees depend on the size category, and the renewal fee is payable after every two years. The figures below are those printed in the 2021 Second Schedule; check the ODPC data portal for the current amount before relying on them.

Illustrative example: a controller whose certificate was issued on 1 March 2026 would hold it for twenty-four months under r.9, so it expires in March 2028 and renewal under r.11 follows that expiry. The dates are invented to show the arithmetic only.

Checking an operator as a player

You cannot read a certificate from inside an app, but you can ask. The terms and privacy statement should name the data controller and a contact for data requests. Ask in writing whether the operator holds an ODPC registration and request the registration details; a licensed operator was required to obtain the data protection certificate before commencing operations.

The regulations also require the ODPC to publish a list of registered controllers and processors on its website once every thirty days (r.14(2)). The register holds names, categories of personal data processed, principal addresses and, where applicable, data protection officer details (r.14(1)). Because the list and the licence status both change, check the current ODPC list and the live Gambling Regulatory Authority register rather than a copy.

If an operator refuses to say, or you think your data is being misused, see how to complain to the ODPC about betting data misuse. For how long your data may be kept once you stop playing, read how long a betting company keeps your personal data.

What registration does not do

Registration does not authorise any particular use of your data. The conduct regulations still limit collection and processing to purposes directly related to administering the gambling operation, and marketing use needs prior consent (r.96(2) and (3)). A registered controller can still breach the Act, and the cancellation power in regulation 16 exists for exactly that case.

Gambling is addictive: play responsibly, and only if you are 18 or over. Help and self-exclusion details are on the responsible gambling page.