Serves under-18s, in Kenya

Kenya Information and Communications (Consumer Protection) Regulations, 2010 (L.N. 54 of 2010), reg. 9 · Read the law's page

• Applies only to licensees under the Kenya Information and Communications Act.
• Establish mechanisms that enable parents and legal guardians to block their children's access to harmful content.

Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page

• Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
• Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
• This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
• Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
• This duty is in effect now and has applied since the Act commenced on 30 May 2018; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.

Data Protection Act, 2019 (No. 24 of 2019), ss. 1-30 (establishment, principles and obligations) · Read the law's page

• Process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose, and collect no more than is necessary for that purpose.
• Register with the Office of the Data Protection Commissioner if your volume or category of processing meets the prescribed threshold.
• Obtain consent from a child's parent or guardian, verified through an age-verification mechanism, before processing that child's personal data.