Skip to main content
← Back to solutions Hotspot billing in Kenya →

Kenya Compliance

Get Your Hotspot Business Legal: A Starter Guide (Kenya)

For Paygrid ISPs. Paperwork checklist for registering a hotspot business with KRA, your county, and Communications Authority requirements in mind.

Quick checklist: what every Kenyan hotspot operator should have

# Document Where Cost (KES) Time Optional?
1 KRA PIN (Personal or Business) iTax Free Same day No
2 Business registration (Sole Prop or Pvt Ltd) BRS (business.go.ke) 950 - 10,650 1-3 days Strongly recommended
3 County Single Business Permit Your county hall 5,000 - 20,000 1-7 days No
4 ODPC Data Controller registration odpc.go.ke 4,000 / year Same day Required by law
5 M-Pesa Till or Paybill (Buy Goods) Safaricom Free + ~1% / tx 1-5 days No (for payments)
6 CA-type-approved router Reputable vendor Built into price At purchase Verify before deploy
7 Business-class internet line Safaricom / Faiba / others ~2× residential Same day Strongly recommended
8 CA Application Service Provider (ASP) license Communications Authority ~80,000+ / year 2-8 weeks Grey area: see section 7

Practical minimum to start: #1, #2, #3, #5. Add #4 immediately. It is cheap and the Data Protection Act has teeth.

1 KRA PIN

You cannot open a Safaricom till or rent a shop without one. Two flavours:

  • Personal PIN: fine if you operate as yourself (sole proprietor).
  • Company PIN: separate from your personal one; required once you register a limited company.

Get it free at iTax (itax.kra.go.ke). Usually takes minutes.

If annual hotspot revenue will cross KES 5,000,000, register for VAT (16%). Below that you are typically under Turnover Tax (3% of gross monthly turnover, filed via iTax). PayGrid Billing payment and revenue reports give you the monthly totals you need to file.

2 Business registration

Pick one:

  • Sole Proprietorship: about KES 950 to register a Business Name at BRS (business.go.ke). Fast. You are personally liable for everything.
  • Limited Company (Pvt Ltd): about KES 10,650 for the standard package. Limits personal liability and looks cleaner to schools, plazas, and churches that want a registered counterparty.

If you handle customer money and customer data, a Pvt Ltd is usually the better long-term choice. Registration is a one-time fee.

3 County Single Business Permit

Every Kenyan county issues an annual permit for businesses operating inside its borders. Cost depends on county, category, and sometimes staff count:

  • Nairobi small business: roughly KES 10,000-15,000 / year
  • Smaller counties: roughly KES 5,000-8,000 / year

This is the document a county askari will ask to see. Get it before you open a paid hotspot. Apply at county headquarters or via the county online portal.

4 ODPC Data Controller registration (Data Protection Act, 2019)

If your hotspot collects customer phone numbers, MAC addresses, payment records, or session logs, you are a Data Controller under Kenya’s Data Protection Act, 2019, and you must register with the Office of the Data Protection Commissioner (ODPC).

ODPC has issued multi-million shilling fines. The Act allows penalties of up to 1% of annual turnover for serious breaches.

4.1 Registration fee: pick your tier

Fees follow the Data Protection (General) Regulations, 2021, Second Schedule. They key off annual turnover, not customer count:

Tier Annual turnover (KES) Annual fee (KES)
Small entity ≤ 5,000,000 4,000
Medium entity 5,000,001 - 50,000,000 14,000
Large entity > 50,000,000 25,000

Most Paygrid operators sit in the small-entity band.

4.2 How to register: step by step

  1. Go to odpc.go.ke → Register → choose Data Controller.
  2. Create an account with your business email and verify the link ODPC sends.
  3. Fill the organisation form. Have ready:
    • Legal name (must match your BRS certificate)
    • KRA PIN of the business
    • Physical address (same as county permit)
    • Designated contact person, phone, email
    • Website / captive portal URL
  4. Declare categories of personal data you process (see section 4.3).
  5. Declare purposes (internet access, payment processing, fraud prevention, etc.).
  6. Describe safeguards. For most Paygrid ISPs an honest answer is: data hosted on TLS-secured infrastructure via your SaaS provider (ALXTEXH ENTERPRISE), with role-based access controls.
  7. Pay via the M-Pesa Paybill ODPC publishes on the portal, card, or bank transfer.
  8. Keep the certificate PDF. Renewal is annual. Set a calendar reminder.

4.3 Categories you must declare (typical hotspot ISP)

Category Typical hotspot meaning Purpose Lawful basis
Identification data Customer phone number (M-Pesa STK) Service delivery, payment, receipt Contract performance
Network identifiers MAC address, assigned IP, device hostname Granting session, fraud prevention Contract + legitimate interest
Location data Which router / hotspot site connected Service delivery, network ops Contract performance
Transaction data M-Pesa receipt code, amount, package Payment processing, accounting Contract + legal obligation (KRA)
Usage / session logs Session start/end, bytes in/out Network operations, CA readiness Legitimate interest + legal obligation

You usually do not declare biometric data, health data, ID numbers, or bank-account numbers (M-Pesa receipts are not bank accounts). If you add KYC (ID photos, selfies), re-register those categories.

4.4 Retention: how long to keep what

Data Default retention Why
Payment records 5 years KRA Tax Procedures Act, s.23
Session / usage logs 6 months Reasonable ISP ops; CA often expects ≥ 90 days
MAC to phone mapping 6 months after last session Linked to session logs
Marketing consents Until withdrawn DPA: consent must be revocable
Closed-account data 30 days after closure, then delete Chargeback / dispute cooling-off

4.5 Data-subject rights you must honour

Kenyan customers have these rights under the DPA. Aim to respond within 7 working days:

  • Informed: privacy policy on the captive portal / terms page.
  • Access: copy of phone, MAC, sessions, payments you hold.
  • Rectification: fix wrong data on request.
  • Erasure: delete where law allows (tax records under 5 years stay).
  • Object: especially marketing; one-click opt-out.
  • Portability: CSV export is fine.

For most small operators, a WhatsApp number on the receipt is enough. Pull the subscriber record from the Paygrid admin and reply.

4.6 Privacy Policy (required)

Customers must be able to read your privacy terms before they hand over data. On Paygrid, publish them in your tenant Terms & Privacy page (/terms-and-conditions) and keep the captive portal link pointing there. A fill-in template is in Appendix A.

5 M-Pesa Buy Goods (Till) or Paybill

You cannot take payments without it. Two common options:

  • Buy Goods Till: most common for small hotspots; ~1% per transaction.
  • Paybill: useful when you want an account reference (room, voucher, site).

Apply via Safaricom Business or a Safaricom shop with KRA PIN, business registration, and ID. Usually live in 1-5 days.

PayGrid Billing handles STK Push once your till/paybill is configured in payment settings. You do not need your own Daraja producer account just to run a hotspot. See also our M-Pesa ISP billing page.

6 Equipment + internet line

MikroTik routers from reputable Kenyan distributors are typically already CA type-approved. If you imported a router directly, check the CA type-approval register before deploying. Non-approved radio gear is technically illegal.

Internet line truth that beginners miss:

  • Residential fibre (Home Fibre / Faiba Home): ToS usually forbid commercial reselling. Heavy abusers get cut off.
  • Business fibre: explicit resale terms, better SLA, static IP options, roughly 2× residential price.

For a serious hotspot, get a business line. The price gap shrinks once you earn about KES 10,000+ / month from the site.

7 The grey area: CA Application Service Provider license

A strict reading of the Communications Authority Unified Licensing Framework puts paid public Wi-Fi under the ASP category (ASP-T1 / ASP-T2). Indicative costs:

  • ASP-T1: about USD 1,000 initial + USD 500 / year (roughly KES 130,000 initial + KES 65,000 / year).
  • ASP-T2: about USD 500 initial, less common for small shops.

In practice, many single-router operators run without an ASP license. CA attention usually focuses on cable laying, outdoor radios, and larger WISP setups. Decide based on your risk.

When you should seriously pursue one:

  • You run ≥ 10 routers across multiple locations
  • You advertise publicly under a visible brand
  • You bid on government / NGO / school tenders
  • You want zero regulatory ambiguity

8 Customer-facing requirements

Three things should be visible to a customer on your hotspot:

  • Business name and KRA PIN on receipts / confirmation (configure in tenant settings).
  • Privacy / terms link on the captive portal (tenant /terms-and-conditions).
  • Support contact: phone or WhatsApp; Paygrid can surface this from portal settings.

Cost cheat sheet (year 1, sole prop in Nairobi)

Item Cost (KES)
Business Name registration 950
KRA PIN 0
County Single Business Permit ~12,000
ODPC registration 4,000
Subtotal (practical minimum) ~17,000
Pvt Ltd registration (if you upgrade) + 10,650
Business internet (vs residential, year 1 diff) + ~30,000
CA ASP-T1 (if you go fully licensed) + ~130,000
All-in serious operator ~190,000

Most operators land in the KES 17K-50K bracket for year-one paperwork. That is the realistic floor before business fibre or a full ASP license.

Resources

What Where
KRA iTax itax.kra.go.ke
Business Registration Service brs.go.ke / business.go.ke
Office of the Data Protection Commissioner odpc.go.ke
Communications Authority of Kenya ca.go.ke
CA type-approval register ca.go.ke → Resource Centre → Type Approval Register
Nairobi single permit epayments.nairobi.go.ke
Safaricom Business (Till / Paybill / Business Fibre) safaricom.co.ke/business

Appendix A: Privacy Policy template (fill in the blanks)

Copy into a public page, replace the bracketed fields, then paste the same text into your tenant Privacy Policy under Terms & Privacy so the captive portal link stays accurate.

Privacy Policy: [BUSINESS NAME] Wi-Fi

Last updated: [YYYY-MM-DD]

[BUSINESS NAME] (“we”, “us”, “our”) operates paid Wi-Fi hotspots in Kenya. This policy explains what personal data we collect when you connect, why we collect it, how long we keep it, and your rights. We comply with the Kenya Data Protection Act, 2019 (“the Act”) and are registered with the Office of the Data Protection Commissioner (“ODPC”) as a Data Controller.

1. Who we are

  • Business name: [BUSINESS NAME, AS REGISTERED AT BRS]
  • KRA PIN: [Pxxxxxxxxxxx]
  • Physical address: [BUSINESS ADDRESS]
  • Data protection contact: [EMAIL] / [PHONE / WHATSAPP]
  • ODPC registration: Data Controller, certificate no. [REG-NUMBER]

2. What data we collect

  • Phone number: for M-Pesa STK Push and receipts
  • Network identifiers: MAC, assigned IP, device hostname
  • Session location: which hotspot site you used
  • Transaction details: M-Pesa code, amount, package
  • Session logs: start/end time and data used

We do not collect ID numbers, biometrics, banking credentials, or browsing history of websites you visit.

3. Why we collect it

  • Granting internet access: contract performance (s.30(b))
  • Processing M-Pesa payments: contract + tax legal obligation
  • Fraud / abuse prevention: legitimate interest (s.30(f))
  • KRA / CA compliance: legal obligation (s.30(c))
  • Marketing: only with consent (s.30(a)), withdrawable any time

4. Who we share it with

  • Safaricom PLC: to process M-Pesa payments
  • ALXTEXH ENTERPRISE: operator of PayGrid Billing, acting as a Data Processor on our written instructions
  • Kenya Revenue Authority: when required by law
  • Communications Authority / law enforcement: when compelled by lawful order

We do not sell your data. We do not transfer it outside Kenya without Part VI safeguards.

5. How long we keep it

  • Payment records: 5 years (Tax Procedures Act)
  • Session logs: 6 months from session end
  • MAC to phone mapping: 6 months from last session
  • Marketing consents: until withdrawn
  • Closed accounts: 30 days, then deleted

6. Your rights

Under the Act you may be informed, access, rectify, erase (subject to legal retention), object, port your data, withdraw consent, and lodge a complaint with ODPC at odpc.go.ke. Contact us at [EMAIL] or [WHATSAPP / PHONE]. We respond within 7 working days.

7. Security

We apply reasonable technical and organisational measures including TLS transport, access controls, and backups. If a breach affecting your data occurs, we will notify you and the ODPC within 72 hours as required by s.43 of the Act.

8. Children

Our service is intended for users aged 18 and over. If you are under 18, ask a parent or guardian to purchase on your behalf.

9. Changes

We may update this Policy. The “Last updated” date shows when it last changed. Material changes will be announced on our captive portal.

10. Contact

[BUSINESS NAME] · [PHYSICAL ADDRESS] · [EMAIL] · [PHONE / WHATSAPP]

ODPC complaints: odpc.go.ke · [email protected] · +254 (0)20 252 8101

Disclaimer

This guide is not legal, tax, or financial advice. Kenyan regulations change. Always verify current requirements with the relevant authority before relying on this document. For tenders, multi-county fleets, or contested matters, engage a Kenyan ICT lawyer.

Maintained for PayGrid Billing operators by ALXTEXH ENTERPRISE.

Run hotspot billing with the basics covered

Paygrid covers M-Pesa activation, captive portals, RADIUS control, and admin tools that help you keep payment and subscriber records organised for ODPC and KRA work.

Start Free Trial Talk to sales