Skip to main content
← Back to solutions Hotspot billing in Kenya →

Kenya Compliance

Kenya compliance topics for hotspot and ISP operators

For PayGrid Billing ISPs. Paperwork checklist for registering a hotspot business with KRA, your county, and Communications Authority requirements in mind.

Quick checklist: topics to verify for your ISP

# Topic to check Authority / provider Cost Timing Action
1 Tax registration and obligations KRA Check current KRA guidance Varies Confirm for your business
2 Business registration Business Registration Service Use current fee schedule Varies Choose the right entity
3 County permits Your county government Varies by county and activity Varies Confirm locally
4 Data protection registration ODPC Depends on eligibility and category Varies Check scope with ODPC
5 Merchant payment account Safaricom or another provider Provider fees vary Provider sets timing Confirm account and fees
6 Radio equipment type approval Communications Authority Check current register Before purchase / use Verify each model
7 Commercial internet service Your ISP / upstream provider Contract-specific Provider sets timing Confirm permitted use
8 Communications licensing Communications Authority Depends on current licence category Varies Ask CA about your activity

This checklist is a set of items to verify, not a universal list of licences or legal requirements. Applicability depends on your activity and current regulator guidance.

1 KRA PIN

Confirm the tax registrations and filings that apply to your business with KRA. The right registration depends on your legal structure and activities.

  • Personal PIN: fine if you operate as yourself (sole proprietor).
  • Company PIN: separate from your personal one; required once you register a limited company.

Start with KRA iTax and KRA’s current guidance on VAT and Turnover Tax. Thresholds and rules can change; check the current pages or ask KRA before selecting a tax treatment.

Do not infer the applicable tax from a single revenue figure alone. VAT and turnover tax have separate eligibility rules, exclusions, and rates. PayGrid Billing reports can help you review recorded activity; they do not determine your tax treatment or file a return for you.

2 Business registration

Pick one:

  • Business Name: use the current fee and process published by the Business Registration Service.
  • Limited company: check the current BRS application, fees, and filing obligations. Different structures have different legal and tax consequences.

Select an entity with advice appropriate to your circumstances. The BRS official fee schedule is the reference for current published charges.

3 County Single Business Permit

County permits, categories, charges, and application processes vary. Ask the county government responsible for each operating location whether your business activity needs a permit and what current documents and fees apply.

  • Do not rely on a fee estimate for another county or business category.
  • Retain the county's current fee notice and payment receipt.

Use the county’s official website or office to confirm whether a permit applies to your site and business activity. Requirements and terminology are not uniform across counties.

4 ODPC registration and data protection

Handling personal data makes data protection obligations relevant, but registration is not determined by the presence of a phone number or session record alone. ODPC guidance sets registration criteria and exceptions by organisation size, turnover, and processing category. Confirm whether your ISP must register directly with the Office of the Data Protection Commissioner (ODPC).

Regardless of registration status, assess your controller and processor roles, lawful purposes, notices, safeguards, retention, and data-subject request process against the Act and current ODPC guidance.

4.1 Published registration fee schedule

The ODPC guidance lists these fees by category. Category eligibility is based on its current criteria; confirm the category and whether registration applies before paying. See the ODPC registration guidance note and current compliance guidance.

ODPC category Initial registration fee Renewal fee (24 months)
Micro / small KES 4,000 KES 2,000
Medium KES 16,000 KES 9,000
Large KES 40,000 KES 25,000

Do not assume a category based on subscriber count or platform use. ODPC may update its criteria and fees; use its current portal and published guidance.

4.2 How to register: step by step

  1. Read the current ODPC registration guidance and confirm that registration applies to your organisation.
  2. If applicable, use the ODPC registration portal and follow its current process.
  3. Fill the organisation form. Have ready:
    • Legal name (must match your BRS certificate)
    • KRA PIN of the business
    • Physical address (same as county permit)
    • Designated contact person, phone, email
    • Website / captive portal URL
  4. Declare categories of personal data you process (see section 4.3).
  5. Declare purposes (internet access, payment processing, fraud prevention, etc.).
  6. Describe safeguards. For most PayGrid Billing ISPs an honest answer is: data hosted on TLS-secured infrastructure via your SaaS provider (ALXTEXH ENTERPRISE), with role-based access controls.
  7. Pay via the M-Pesa Paybill ODPC publishes on the portal, card, or bank transfer.
  8. If registration is required, retain the certificate and follow the renewal period shown by ODPC.

4.3 Categories you must declare (typical hotspot ISP)

Category Possible example Possible purpose Review before use
Identification data Customer phone number Account, service, payment Document your lawful basis
Network identifiers MAC address, assigned IP Granting and supporting a session Document your lawful basis
Location data Hotspot site used Service delivery and support Collect only what is needed
Transaction data Payment reference, amount, package Payment records and reconciliation Confirm applicable obligations
Usage / session logs Session time and data used Network operations and support Set a justified retention period

Use this table only as an inventory prompt. Record every category your organisation actually handles, including sensitive data if applicable, and follow ODPC guidance for updating any registration or compliance records when your processing changes.

4.4 Retention: how long to keep what

Data Retention approach Check
Payment records Keep for the period required for your tax and accounting duties Confirm with KRA / adviser
Session / usage logs Set and document a purpose-based period Check current legal and service needs
Network identifier links Keep only while needed for a stated purpose or obligation Review and securely dispose
Marketing consents Keep consent status and honor withdrawal Collect only necessary evidence
Closed-account data Delete or anonymize when no longer needed, subject to obligations Document exceptions

4.5 Data-subject rights and request handling

Review the rights and response deadlines set out in current law and ODPC guidance. Establish a way for customers to submit requests and for your organisation to assess and respond to them.

  • Informed: privacy policy on the captive portal / terms page.
  • Access: copy of phone, MAC, sessions, payments you hold.
  • Rectification: fix wrong data on request.
  • Erasure: assess deletion requests against applicable law and retention obligations.
  • Object: especially marketing; one-click opt-out.
  • Portability: CSV export is fine.

Publish a monitored contact channel. Verify the requester’s identity proportionately and respond using the process and timeframes that apply to your case.

4.6 Privacy notice and transparency

Explain your data practices to customers before or when data is collected, as applicable. In PayGrid Billing, you can publish your own notice in the tenant Terms & Privacy page (/terms-and-conditions) and keep the captive portal link pointing there. A fill-in template is in Appendix A.

5 M-Pesa Buy Goods (Till) or Paybill

A merchant account and provider configuration are needed for the payment methods you offer. Common M-Pesa options include:

  • Buy Goods Till: ask the provider for eligibility, settlement terms, and current charges.
  • Paybill: useful when you want an account reference (room, voucher, site).

Apply through the provider and confirm its current eligibility, documentation, fees, and setup timeline directly. Approval and settlement are controlled by the provider.

PayGrid Billing can send STK Push requests through a configured supported integration. The merchant account, provider approval, credentials, and callback setup remain your responsibility. See also our M-Pesa ISP billing page.

6 Equipment + internet line

Verify the exact model and applicable approval status in the current Communications Authority type-approval register before purchase or deployment. Do not rely only on a reseller’s general claim or a similar model number.

Internet line truth that beginners miss:

  • Any upstream service: read the provider contract and confirm that the intended commercial resale or public access use is permitted.
  • Business service: compare written acceptable-use terms, support commitments, and price for your sites.

Choose a service whose contract and capacity fit your deployment. Prices and allowed use vary by provider and plan.

7 Communications licensing and radio approvals

The Communications Authority's licensing framework and categories can change, and the correct licence depends on the service and network activity. Do not assume every hotspot needs the same licence or that a particular ASP category applies. Review the current CA market structure and licence forms and fees, then ask the Authority which category applies to your actual activity.

Fees, application requirements, and licensing terminology depend on the Authority’s current publications. This page cannot determine your licensing obligation.

Ask CA about the licence category for your specific network, service, radio equipment, and geographic scope, and retain its written guidance.

8 Customer-facing requirements

Three things should be visible to a customer on your hotspot:

  • Business name and KRA PIN on receipts / confirmation (configure in tenant settings).
  • Privacy / terms link on the captive portal (tenant /terms-and-conditions).
  • Support contact: phone or WhatsApp; PayGrid Billing can surface this from portal settings.

Cost cheat sheet (year 1, sole prop in Nairobi)

Item How to confirm
Business registration Check the current BRS fee schedule
Tax registration and filing Check current KRA requirements
County permits Ask the county responsible for each site
ODPC registration Confirm scope and category with ODPC
Merchant payment account Get current written provider pricing
Business internet Compare commercial plans and acceptable use terms
Communications licence Confirm the correct category and fees with CA
Total operating cost Calculate from your location, activity, and chosen providers

Most operators land in the KES 17K-50K bracket for year-one paperwork. That is the realistic floor before business fibre or a full ASP license.

Resources

What Where
KRA iTax itax.kra.go.ke
Business Registration Service brs.go.ke / business.go.ke
ODPC registration guidance and fees odpc.go.ke – registration guidance
Communications Authority licensing ca.go.ke – current market structure and fees
CA type-approval register ca.go.ke → Resource Centre → Type Approval Register
Nairobi single permit epayments.nairobi.go.ke
Safaricom Business (Till / Paybill / Business Fibre) safaricom.co.ke/business

Appendix A: Sample privacy notice template for ISP operators

This sample is not PayGrid Billing’s privacy policy, and it does not describe PayGrid Billing’s processing practices. An ISP may adapt it for its own customers only after reviewing every statement, replacing placeholders, and confirming it matches its real data practices.

Privacy Policy: [BUSINESS NAME] Wi-Fi

Last updated: [YYYY-MM-DD]

[BUSINESS NAME] (“we”, “us”, “our”) operates [DESCRIBE YOUR SERVICE AND LOCATIONS]. This example must be rewritten to describe the data your ISP actually collects, how it uses it, the relevant safeguards, and the rights available to customers. State ODPC registration only if it applies and is verified; otherwise remove that claim.

1. Who we are

  • Business name: [BUSINESS NAME, AS REGISTERED AT BRS]
  • KRA PIN: [Pxxxxxxxxxxx]
  • Physical address: [BUSINESS ADDRESS]
  • Data protection contact: [EMAIL] / [PHONE / WHATSAPP]
  • ODPC registration, if applicable and verified: [DETAILS]

2. What data we collect

  • Phone number: for M-Pesa STK Push and receipts
  • Network identifiers: MAC, assigned IP, device hostname
  • Session location: which hotspot site you used
  • Transaction details: M-Pesa code, amount, package
  • Session logs: start/end time and data used

[Describe accurately any data you do not collect. Remove this statement if you cannot verify it.]

3. Why we collect it

  • Granting internet access: contract performance (s.30(b))
  • Processing M-Pesa payments: contract + tax legal obligation
  • Fraud / abuse prevention: legitimate interest (s.30(f))
  • KRA / CA compliance: legal obligation (s.30(c))
  • Marketing: only with consent (s.30(a)), withdrawable any time

4. Who we share it with

  • Safaricom PLC: to process M-Pesa payments
  • ALXTEXH ENTERPRISE: operator of PayGrid Billing, acting as a Data Processor on our written instructions
  • Kenya Revenue Authority: when required by law
  • Communications Authority / law enforcement: when compelled by lawful order

[Describe accurately any sale, sharing, service providers, and cross-border transfers. Do not claim a location or safeguard without verifying it.]

5. How long we keep it

[Insert the retention period for each data category and explain applicable exceptions. Check your legal and operational requirements before publishing a period.]

6. Your rights

Under the Act you may be informed, access, rectify, erase (subject to legal retention), object, port your data, withdraw consent, and lodge a complaint with ODPC where the law provides those rights. Contact us at [EMAIL] or [WHATSAPP / PHONE]. [State your verified request-handling process and any applicable statutory timelines.]

7. Security

[Describe safeguards you actually use and your verified data-breach response and notification process. Confirm legal requirements before publishing specific deadlines.]

8. Children

[Describe the age range and any safeguards that actually apply to your service.]

9. Changes

We may update this Policy. The “Last updated” date shows when it last changed. Material changes will be announced on our captive portal.

10. Contact

[BUSINESS NAME] · [PHYSICAL ADDRESS] · [EMAIL] · [PHONE / WHATSAPP]

ODPC complaints: odpc.go.ke · [email protected] · +254 (0)20 252 8101

Disclaimer

This guide is not legal, tax, or financial advice. Kenyan regulations change. Always verify current requirements with the relevant authority before relying on this document. For tenders, multi-county fleets, or contested matters, engage a Kenyan ICT lawyer.

Maintained for PayGrid Billing operators by ALXTEXH ENTERPRISE.

Run hotspot billing with the basics covered

PayGrid Billing covers M-Pesa activation, captive portals, RADIUS control, and admin tools that help you keep payment and subscriber records organised for ODPC and KRA work.

Start Free Trial Talk to sales