KenyaComputer Misuse and Cybercrimes Act, Reporting of Cyber Threat
Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
- Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
- Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
- Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
- This duty is in effect now and has applied since the Act commenced on ; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A person who fails to report an attack, intrusion, or disruption under section 40(1) commits an offence and is liable, on conviction, to a fine not exceeding two hundred thousand shillings, imprisonment not exceeding two years, or both.
Penalty structure
Section 40(4)'s fine cap of two hundred thousand shillings; the same subsection separately authorises imprisonment for up to two years, either alone or in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- KES
- Fixed cap
- 200,000
Who enforces it
Enforcement body
The National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Computer Misuse and Cybercrimes Act, 2018, is the body section 40(1) directs a report to.
What this law does
Any person who operates a computer system or a computer network in Kenya, whether public or private, must immediately inform the National Computer and Cybercrimes Co-ordination Committee of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
The report must include a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance delaying their notification. The Committee may propose isolating a suspected system pending resolution. Failing to report under this duty is itself an offence, punishable by a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .