Most logistics firms don't think of themselves as data businesses. But look at what passes through a typical fleet or freight office in a week: drivers' ID cards and licences, customers' names and phone numbers, consignee details, M-Pesa payment records, CCTV footage from the yard, and GPS tracks showing where every vehicle went.

All of that is personal data under Kenya's Data Protection Act, 2019. And the Office of the Data Protection Commissioner (ODPC) has moved firmly from awareness to enforcement.

Why this matters now

  • Fines are real. The ODPC can impose administrative fines of up to KSh 5 million or 1% of annual turnover, whichever is lower, per infringement.
  • Registration is being chased. In August 2026 the ODPC gave organisations with expired registration certificates 14 days to renew or face enforcement.
  • Your clients are checking. Corporate procurement teams increasingly screen vendors for ODPC registration. An unregistered transporter can lose a contract before price is even discussed.

Does registration apply to you?

Registration is mandatory for organisations whose core activities fall in certain categories. Two of them catch many logistics businesses:

  • Processing of location data. If you run GPS tracking on your fleet, this is likely you.
  • Financial services. This includes payments and lending. If you collect payments on behalf of others, take a close look.

Outside the mandatory categories, registration depends on thresholds such as turnover and staff numbers. If you are unsure, get a lawyer to confirm. It is a short conversation compared with an enforcement notice.

The checklist

Registration is the entry ticket, not the finish line. A compliant logistics firm also does the following.

1. Map your data. List what personal data you hold, where it lives (WhatsApp groups and Excel sheets count), why you hold it, and who you share it with. Most firms find data in places nobody remembered.

2. Register with the ODPC, or confirm in writing why you don't need to. Put the renewal date in a calendar with an owner.

3. Publish privacy notices. Customers, drivers and staff should know what you collect and why. A one-page notice at onboarding and on your website covers most of it.

4. Get a lawful basis for each use. Tracking a vehicle for fleet security is different from tracking a driver's personal phone. Each purpose needs a basis under the Act, such as contract, legal obligation or legitimate interest.

5. Lock down access. Not everyone needs to see driver ID scans or customer phone numbers. Use role-based access in your systems and stop sharing personal data in open group chats.

6. Sign proper contracts with processors. If a tracking provider, cloud host or payroll bureau handles personal data for you, your contract with them needs data protection terms, including breach notification.

7. Plan for breaches. The law expects the ODPC to be notified within 72 hours of discovering a personal data breach. Decide now who makes that call and how.

8. Do impact assessments for high-risk processing. Continuous GPS tracking and CCTV are good candidates. A data protection impact assessment (DPIA) records the risk and how you reduce it.

9. Train your team. Most breaches start with a person, not a system: a phone left unlocked, a spreadsheet sent to the wrong client.

10. Review every year. Data maps go stale and certificates expire.

Where technology helps

Several items on this list are easier with the right systems: access controls, audit logs, automatic deletion of old records, and reminders before your registration lapses. These are the same tools we build into the systems we deliver, so compliance is part of how the software works rather than a document in a drawer.

This article is general information, not legal advice. For your specific situation, speak to a qualified advocate.