01About ODPC Registration
The Office of the Data Protection Commissioner (ODPC) is Kenya's data protection regulatory authority, established under the Data Protection Act, 2019 (Cap. 411C). The ODPC oversees the implementation and enforcement of data protection laws in Kenya, ensuring that personal data of Kenyan citizens and residents is processed lawfully and with appropriate safeguards.
As a technology company that processes personal data on behalf of our customers — including employee records, payroll data, and HR information — OnTap (operated by Belfortech Ltd) is required by law to register as a Data Processor with the ODPC.
02Our Registration Status
Full registration certificate and registration number are available to enterprise customers and regulatory authorities upon request. Contact legal@ontapke.com for verification.
03Our Obligations Under the DPA 2019
As a registered Data Processor, Belfortech Ltd (OnTap) is bound by the following obligations under the Kenya Data Protection Act, 2019:
- Lawful Processing: We process personal data only on documented instructions from our customers (Data Controllers) or where we have a lawful basis to do so.
- Data Subject Rights: We support and facilitate the exercise of data subject rights including access, rectification, erasure, and portability within required timeframes.
- Security Measures: We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security audits.
- Data Breach Notification: We report any personal data breaches to the ODPC and affected Data Controllers within 72 hours of becoming aware of a breach.
- Sub-processor Management: We ensure that any sub-processors we engage are bound by equivalent data protection obligations through contractual arrangements.
- Data Transfers: We ensure that any cross-border transfers of personal data are conducted in accordance with the DPA 2019 requirements.
- Record Keeping: We maintain records of all processing activities as required under the Act.
04Data Subject Rights Under Kenyan Law
Under the Kenya Data Protection Act, 2019, individuals whose personal data we process have the following rights:
Right to be Informed
You have the right to know how your personal data is being collected and used — including the purpose, legal basis, and retention period.
Right of Access
You may request a copy of all personal data we hold about you, including information on how it is processed.
Right to Rectification
You may request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure
You may request deletion of your personal data where there is no legitimate reason for us to continue processing it.
Right to Object
You may object to processing of your personal data where it is based on legitimate interests or for direct marketing purposes.
Right to Data Portability
You may request transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format.
Right to Lodge a Complaint
You have the right to lodge a complaint with the ODPC if you believe your data rights have been violated.
05Contacting the ODPC
If you have concerns about how your personal data is being handled by OnTap that we have not resolved to your satisfaction, you have the right to contact the ODPC directly:
To exercise your data rights with us directly, contact our Data Protection Officer at info@ontapke.com. We will respond to all requests within 30 days.
Questions about this policy?
Our legal and compliance team is happy to help.