13.

(1) For purposes of this regulation—
“revenue” means the total income of profit-making data
controllers or data processors for the year immediately preceding the
year of registration;
“turnover” means the utilized annual budget of non-profit making
data controllers or data processors for the year immediately preceding
the year of registration;
“non-profit making data controller or data processors” means an
entity whose core mandate excludes the generation of profit and
includes non-governmental organizations, charitable and religious
institutions, multi-lateral agencies or civil society organizations.
(2) A data controller or data processor is exempt from mandatory
registration under these Regulations where the data controller or data
processor—
(a) has an annual turnover of below five million shillings or
annual revenue of below five million shillings; and
(b) has less than ten employees.
(3) Despite the provisions of sub-regulation (2), the data
controller and data processor exempt under sub-regulation (2) shall be
required to comply with the provisions of the Part IV and Part VI of the
Act.
(4) The exemption provided under sub-regulation (1) shall not
apply to a data controller or data processor whose annual turnover is
below five million shillings and processes personal data for the
purposes specified under the Third Schedule.
(5) The data controllers and data processors contemplated under
sub-regulation (2), shall be required to undertake mandatory
registration in accordance with Part III of the Act and these
Regulations.