MEDICAL PRACTITIONERS - COMPLIANCE WITH THE DATA PROTECTION ACT

Kenya has been doing an impressive job of ensuring that all institutions and business that handle any data from the public have put measures in place to ensure that data privacy is enhanced and upheld.

Recently the medical industry hopped on the bandwagon through the directive issued by the Kenya Medical Practitioners and Dentists Council (KMPDC) requiring all health institutions to obtain certifications as data handlers and/or processors.

For new institutions seeking registration, they will be required to include a certificate of registration from the Office of the Data Protection Commissioner (ODPC).

A grace period was issued to already existing health facilities; they will be required to complete their registration process and obtain certification by the 31st of March, 2025.

The registration costs are as follows:

1. Micro and small facilities - Kshs. 4,000 (1-50 employees with an annual turnover of Kshs. 5 million and below)
2. Medium facilities - Kshs. 16,000 (51 - 99 employees with an annual turnover of between Kshs. 5-50 million).
3. Large facilities - Kshs. 40,000 (100+ employees with an annual turnover of Kshs. 50 million and above).

Please note that the above costs are exclusive of any fees and costs that may be incurred when retaining the services of legal professionals to carry out the process for you.

In the event of non-compliance, an institution may face fines of upto Kshs. 5 million or 1% of the annual turnover, whichever is lower.

For individuals, a fine of upto Kshs. 3 million or 10 years imprisonment or both.

The penalties may seem stringent compared to other industries, however, it is important to note that the medical facilities handle very sensitive data and measures should be put in place so as to ensure utmost privacy of the data.

Reach out to us for further clarification or any inquiries on [email protected]