Kenya software delivery: settle registration, transfers and M-Pesa before the build

OutsourcingVN is operated by Netbase JSC, so this guide comes from a supplier that would like your project. It draws on a comparable African directory platform Netbase has built and on Kenya's official data-protection and mobile-money references for the questions your own advisers should answer. The guides index lists the guides for other markets.

Contents

• What makes a Kenya-facing build different?
• What did Netbase build for a comparable African directory platform?
• How do you scope registration and cross-border transfers?
• What decisions does an M-Pesa integration need?
• Worked scenario: an M-Pesa prompt that times out
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

What makes a Kenya-facing build different?

Three decisions come up in almost every Kenya-facing brief, and each changes what has to be tested before launch.

• Registration. Kenya's Data Protection Act 2019 requires most data controllers and processors to register with the Office of the Data Protection Commissioner before they process personal data at scale, through a dedicated registration portal.
• Cross-border transfer. Moving personal data outside Kenya needs a documented safeguard or the data subject's own consent, decided case by case rather than assumed from a vendor's general privacy programme.
• Mobile money. M-Pesa payments run through Safaricom's own Daraja platform, so a checkout that only accepts cards misses the payment method most Kenyan consumers reach for first.

A buyer's legal and compliance advisers should start with the Office of the Data Protection Commissioner's own site to confirm whether the product's controller or processor needs to register, and which category of safeguard a given transfer requires. Their conclusion becomes an engineering input: a registration record, a transfer log and a consent flow.

What did Netbase build for a comparable African directory platform?

The closest registered match for a Kenya-facing brief is a multi-state business directory Netbase built in Nigeria, launched in one state with a plan to scale nationwide. The platform pairs a server-rendered, mobile-first directory of state, city and category pages with phone one-time-password sign-in, a location badge that field agents verify with geotagged photos and identity capture before a head-office reviewer approves it offline-first, five administrator roles each with their own dashboard, subscription billing split across two providers, and business messaging with an SMS fallback, all delivered on a twelve-week combined web and mobile plan. See the multi-state business directory record for the full scope; the client is not named.

How do you scope registration and cross-border transfers?

Kenya's Data Protection Act ties registration and transfer decisions to how the product actually handles data, not to its size alone, so scope them before writing a data-processing clause into a contract.

Worked scenario: an M-Pesa prompt that times out

1. Prompt sent. The customer taps "Pay with M-Pesa" and an STK push notification appears on their phone.
2. No response. The customer does not enter their PIN within the window Safaricom allows, and the prompt expires.
3. Callback received. Safaricom's callback reports the failed request; the app marks the order "payment not completed" rather than leaving it silent.
4. Retry offered. The checkout offers a fresh prompt rather than reusing the expired one, because Safaricom does not revive a timed-out request.
5. Second attempt succeeds. The customer enters their PIN in time; the callback confirms payment and the order moves to "paid".
6. Support view. An agent taking a call in between sees "first prompt expired, second prompt confirmed" rather than two unexplained orders.

A supplier who cannot describe what happens between steps 2 and 4 has not yet scoped M-Pesa, because a silent timeout is one of the most common complaints on a mobile-money checkout.

Which questions should you ask a supplier?

• Have you integrated Daraja's STK push before, and can we see a completed transaction? Ask for a real callback log, not a slide.
• Who registers with the Data Protection Commissioner? It should be your organisation as the controller, with the supplier advising rather than registering on your behalf.
• What safeguard applies when data leaves Kenya? Expect a named safeguard per destination, not a general assurance.
• What happens on a timed-out M-Pesa prompt? Look for a retry design and a clear order state, not silence.
• Who holds the paybill or till number after handover? It should be your organisation, with the supplier working inside access you grant.
• What is out of scope for the first release? A good proposal names it rather than leaving it implicit.

What usually goes wrong?

• Registration treated as optional. Signal: the product processes personal data at scale with no ODPC registration on file. Owner: the compliance lead.
• Cross-border transfers left undocumented. Signal: a cloud provider outside Kenya with no safeguard on record. Owner: the legal adviser.
• M-Pesa timeouts left silent. Signal: customers unsure whether they paid. Owner: the product owner, with a tested retry flow.
• Shortcode credentials held by the supplier. Signal: the buyer cannot change till settings after handover. Owner: the business sponsor.

How this guide is sourced and where it stops

This guide draws on the Office of the Data Protection Commissioner's own site and Safaricom's Daraja developer portal, both checked on 2026-09-29, and a Netbase delivery record approved in the OutsourcingVN claim register. It is written for founders, product and operations leads preparing a brief. It does not decide whether a specific product must register, or which transfer safeguard applies; those decisions stay with your advisers. Netbase's only office is in Hanoi, Vietnam, and Kenya-facing work is delivered remotely from that base.

Plan the first release

Bring your registration status, your transfer map, your M-Pesa integration type and the names of your compliance, product and support owners. The order and payment operations solution shows how mobile-money events connect to fulfilment, and the total software delivery cost worksheet helps you compare proposals line by line. The methodology page explains how the records on this page are sourced. For other African markets, the Nigeria guide covers two-provider payments and a state-by-state rollout, and the South Africa guide covers POPIA and multi-method checkout.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your payment and registration questions, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions