Sends faxes, in Kenya

Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page

• Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
• Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
• This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
• Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
• This duty is in effect now and has applied since the Act commenced on 30 May 2018; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.

Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (Legal Notice No. 265 of 2021), regs. 4, 9, 11, 13, 15 and 18 · Read the law's page

• Register with the Data Commissioner as a data controller or a data processor, on the application form with a copy of your establishment documents and the registration fee, unless you are exempt under regulation 13(2) because your annual turnover or annual revenue is below five million shillings and you have less than ten employees.
• Register even where your annual turnover is below five million shillings if you process personal data for a purpose listed in the Third Schedule, such as gambling, health administration, the provision of financial services, telecommunications or direct marketing.
• Apply to renew your registration after your certificate of registration expires, which is twenty-four months from the date of issuance.
• Notify the Data Commissioner in writing within fourteen days of any change in your registered particulars.