Does your clinic or hospital have a current Data Handler Certificate? What health facilities keep getting wrong
We still meet clinic owners and hospital administrators who are surprised to learn their facility needs a Certificate of Data Handler or Data Processor from the Office of the Data Protection Commissioner before it can register, renew, or in some cases keep operating cleanly under the law. This requirement from the Kenya Medical Practitioners and Dentists Council has been in force since early 2025, and we are still finding facilities that either never applied, applied once and never followed up, or assumed their general Data Protection Act registration already covered it.
What the requirement actually says
Since the rule took effect, every new health facility registration has needed a valid Certificate of Data Handler or Processor issued by the ODPC as part of the registration file, not as a separate, optional step somewhere down the line. Existing facilities were given a short compliance window to obtain the same certificate retroactively. The penalties attached to operating without it are serious enough that this is not a box worth leaving unticked, however busy the clinical side of the business is.
Why this sits specifically on health facilities, and not every business
Every organisation processing personal data in Kenya has obligations under the Data Protection Act, but health facilities carry a particular weight because patient records are sensitive personal data by definition, diagnoses, treatment history, test results, sometimes HIV status or mental health information, the kind of data that causes real harm to real people if it leaks or is mishandled. The Data Handler or Processor certificate is the mechanism the regulator chose to confirm, facility by facility, that there is an actual data protection practice behind the patient file room, not just a locked cabinet and good intentions.
What's involved in actually getting certified
Registration with the ODPC as a data controller or processor. This is the foundational step, and it has to happen before the facility-specific certificate can be issued.
A documented data protection policy. Covering how patient data is collected, stored, accessed, shared and eventually disposed of, specific to how your facility actually operates, not a generic template with the facility name swapped in.
Evidence of technical and organisational safeguards. Access controls on patient records, whether physical files or an electronic system, staff confidentiality agreements, and a basic breach response procedure that names who does what if records are lost or accessed improperly.
A named point of accountability. Depending on the facility's size and data processing volume, this may need to be a formally appointed Data Protection Officer, which is a separate but closely related requirement we have written about before on this blog.
Staff awareness. Front desk, records, and clinical staff all need to understand the basics of how patient data is meant to be handled day to day, because a policy nobody on the floor can explain is not meaningfully different from having no policy at all.
Where we see facilities fall short, even after applying
The most common gap is not failing to apply at all. It's applying once, getting the certificate, and then letting the underlying practice drift, new staff who were never trained, a records system that changed without the policy being updated, or a certificate nobody realised needed renewing. A Data Handler certificate reflects a point in time. If your facility has added a new electronic medical records system, opened a second branch, or changed how lab results are shared with partner facilities since you were certified, the certificate on the wall may no longer reflect what's actually happening with patient data.
A short compliance check worth running this quarter
Go through this honestly, whether you're a single clinic or a multi-branch facility:
1. Do we hold a current, valid Certificate of Data Handler or Processor, and do we know its renewal date?
2. Does our written data protection policy match how patient data is actually collected and stored today, not how it was handled when we first applied?
3. Can our front desk and records staff explain, in plain terms, who is allowed to access a patient file and when?
4. Have we appointed, or do we need to appoint, a formal Data Protection Officer given our size and data volume?
5. Do we have a documented breach response procedure, and would staff actually know to use it?
The cost of getting this wrong is not just the fine
The statutory penalty for operating a health facility without the required certification is the headline risk, but it is not the only one. A hospital or clinic that cannot show a credible data protection practice is also exposed if a breach ever does happen, both in regulatory consequences and in the harder to quantify damage to patient trust that follows a facility whose records were mishandled. Getting this right once, properly, and then keeping it current is considerably cheaper than managing either of those outcomes after the fact.
We can help you close the gap
We work with clinics and hospitals on exactly this kind of data protection compliance, from the initial ODPC registration and Data Handler certification through to the policy work and staff awareness that keeps it genuinely current. If you are not certain where your facility stands, it is a short conversation to find out.