Provides telecom services, in Kenya

Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page

• Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
• Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
• This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
• Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
• This duty is in effect now and has applied since the Act commenced on 30 May 2018; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.

Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice No. 44 of 2024), reg. 35 · Read the law's page

• This binds a licensed operator of an international or the national internet gateway (reached by declaring that you provide telecom services); it does not depend on a designation of the gateway as critical information infrastructure.
• Comply with the cybersecurity standards provided under the Regulations, which the Committee shall require of you (regulation 35(1)).
• When the Committee asks, submit a safety standards compliance report within thirty days of the request, and prepare, maintain and submit the technical records, internet portal address allocation records and route identification of traffic transiting the national internet gateway (regulation 35(2) and (4)).
• In the event of internet traffic congestion or suspicious activity, report immediately to the Committee on the connection status of the congested route, specifying the solutions for the congestion (regulation 35(3)).