Data protection and how we handle your files
We process payroll for other companies. That makes us a data processor under the Kenya Data Protection Act, 2019, and it changes how we handle everything you send us.
Registration is in progress and the certificate is not yet published here. We would rather say that than leave the page implying otherwise.
Why this page exists
Cerullo & Associates runs payroll on behalf of client companies. That means we handle personal data belonging to people who are not our clients — employee names, national ID numbers, KRA PINs, salaries, SHIF and NSSF records — which makes us a data processor under the Kenya Data Protection Act, 2019.
Registration with the Office of the Data Protection Commissioner is mandatory for firms in that position, and the certificate has to be displayed. When ours is issued it will appear on this page, with the registration number.
What we do with client employee data
- It is processed only to deliver the payroll and statutory filing work each client engages us for.
- Each engagement carries a data processing agreement setting out what we may do with it.
- It is not used for any other purpose, and it is not shared beyond the statutory filings it exists for.
- Retention follows the statutory record-keeping periods, after which it is deleted.
If you are an employee of one of our clients
Your employer is the data controller and we are the processor acting on their instructions. If you want to know what is held about you, your employer is the right first stop — but you are welcome to contact us and we will help you get an answer.
If you are a client
Ask us for a copy of the data processing agreement covering your engagement. If you do not have one on file, that is worth fixing — for both of us.
Book a Free 30-Minute Call.
Bring your last three months of figures in whatever form they are in. Thirty minutes, on WhatsApp or the phone. We tell you what we can see, what we cannot, and what it would take to put right.