What the Act expects, in ERP terms
The Office of the Data Protection Commissioner (ODPC) regulates data controllers and processors. The obligations most relevant to an ERP programme are below.
What that means for the build
Role-based access by least privilege; a log of who viewed or changed sensitive records; retention rules for payroll and HR data; masking in test and training environments; a documented data-processing agreement with your implementer and with Microsoft; and an agreed approach to where data is hosted and processed.
Where we help
We design to the Act in the Design phase, document the processing for your registration and data-protection impact assessment, and support your ODPC obligations. We are a processor on your data and sign a data-processing agreement on request.
Frequently asked questions
Do we need to register with the ODPC?
Many organisations that process personal data must register as data controllers or processors. Check the current registration rules with the ODPC or your legal adviser.
Is cloud hosting allowed?
Cloud hosting is common; the Act places conditions on cross-border processing. We document where data is stored and processed and help you assess it.
Can you sign a data-processing agreement?
Yes, on request, as part of the contract.
General information, not tax or legal advice. Rates, limits and filing rules change; confirm the current position with the Kenya Revenue Authority, the relevant statutory body or your tax adviser before relying on it.
Last reviewed 2026-10-11