Kenya has not enacted an AI-specific statute. The Artificial Intelligence Bill, 2026, a Senate bill gazetted and read a first time in the Senate on , would classify systems by risk, prohibit unacceptable-risk systems outright, and impose transparency, human-oversight and synthetic-media-labelling duties on providers and deployers of higher-risk systems.
Kenya's National Artificial Intelligence Strategy 2025-2030, launched by the Ministry of Information, Communications and the Digital Economy on , is a policy document guiding future legislation rather than a source of enforceable obligations, and the Kenya Bureau of Standards' draft AI code of practice remains an unconfirmed, voluntary standard.
Artificial Intelligence Bill 2026 (Senate Bills No. 4), s. 25 (classification of artificial intelligence systems; unacceptable-risk prohibition)official Bill text, Kenya Gazette Supplement, Kenya Law (new.kenyalaw.org)
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
This measure is the Senate bill numbered 4 of 2026, published in the Kenya Gazette on and read a first time in the Senate on . As drafted, the Cabinet Secretary would classify artificial intelligence systems into unacceptable-risk, high-risk, limited-risk and minimal-risk categories on the recommendation of the Artificial Intelligence Commissioner, and a system classified as unacceptable risk would be prohibited outright.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
This measure is the Senate bill numbered 4 of 2026, published in the Kenya Gazette on and read a first time in the Senate on .
As drafted, a provider or deployer of a high-risk system would have to conduct a risk assessment and a human-rights impact assessment before deployment, ensure transparency, traceability and explainability of the system's decision-making, keep records of training data and performance for at least five years, and obtain explicit consent before generating or manipulating a person's image, voice or likeness.
The Artificial Intelligence Commissioner would maintain a public register of high-risk systems, including those used by county governments.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
This measure is the Senate bill numbered 4 of 2026, published in the Kenya Gazette on and read a first time in the Senate on . As drafted, a provider or deployer of any artificial intelligence system would have to disclose to users and affected persons its nature, purpose and limitations, the extent to which its outputs are automated, and its bias-mitigation measures, and a provider of a high-risk system would have to submit annual compliance reports.
A user of an artificial intelligence system whose automated decisions produce significant legal or similar effects on a person would have to comply with the Data Protection Act by providing safeguards including the right to human intervention, to express views and to contest the decision.
Generating, deploying or distributing synthetic media using a person's image, voice or likeness without their explicit consent, in a way likely to cause harm, misinformation, defamation or an invasion of privacy, would be an offence carrying a fine of up to KES 5,000,000 or imprisonment of up to two years, or both.
Kenya's comprehensive personal-data regime is the Data Protection Act, 2019, which establishes the Office of the Data Protection Commissioner and binds every data controller or processor operating in Kenya or handling the data of a person located in Kenya, whether or not the underlying personal data is otherwise publicly accessible.
The Act treats biometric, genetic, health and several other categories as sensitive personal data carrying heightened processing conditions, requires a controller to verify a child's age and obtain a parent or guardian's consent before processing a child's personal data, and gives every data subject a right against a decision based solely on automated processing that produces a legal or similarly significant effect.
Cross-border transfer requires proof of safeguards to the Commissioner or the data subject's consent, and the Cabinet Secretary may compel certain categories of processing onto a server located in Kenya.
The Data Protection (General) Regulations, 2021 add operational detail on personal data breach notification, data protection impact assessments and data-subject-request timelines, and the Commissioner may impose an administrative fine of up to five million Kenya shillings, or one per cent of an undertaking's annual turnover if lower, alongside criminal penalties for specific offences.
The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 provide that a certificate of registration is valid for a period of twenty-four months from the date of issuance. The Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 require a respondent to a complaint to make representations, review the complaint or provide a response within twenty-one days of the Data Commissioner's notice of it.
The Data Protection (General) Regulations, 2021 elaborate the Act's breach-notification duty and add operational detail on data-subject requests, including a fourteen-day deadline to notify a data subject in writing of a refused restriction request and a seven-day deadline for a refused rectification request.
Regulation 49 requires a data protection impact assessment before processing that includes automated decision-making or profiling with a legal or similarly significant effect, among other high-risk processing operations.
Where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm, a data controller must notify the Data Commissioner without delay, and in any event within seventy-two hours of becoming aware of the breach, giving reasons for any later notification.
A data processor that becomes aware of a breach must notify the data controller within forty-eight hours where reasonably practicable, and the controller must communicate the breach to the affected data subject in writing within a reasonably practical period unless their identity cannot be established.
Regulation 4(1) requires every data controller and data processor to register in accordance with the Act and the Regulations. Regulation 13(2) exempts a data controller or data processor from mandatory registration where it has an annual turnover of below five million shillings or annual revenue of below five million shillings, and has less than ten employees.
Regulation 13(4) withholds that exemption from a data controller or data processor whose annual turnover is below five million shillings and which processes personal data for the purposes specified under the Third Schedule. The Third Schedule lists those purposes, among them gambling, operating an educational institution, health administration, the provision of financial services, telecommunications network or service providers, and businesses wholly or mainly in direct marketing.
Regulation 13(5) also states that the data controllers and data processors contemplated under subregulation (2) are required to undertake mandatory registration in accordance with Part III of the Act and the Regulations. A certificate of registration is valid for a period of twenty-four months from the date of issuance. A registered data controller or data processor must apply for a renewal of registration after the expiry of the certificate of registration.
A data controller or data processor must notify the Data Commissioner in writing within fourteen days of any change in its registered particulars. Processing personal data without registering, providing false or misleading information for registration, or failing to renew a certificate of registration and continuing to process personal data after it expires is an offence liable to the penalty specified under section 73 of the Act. Regulation 1(2) brings the Regulations into effect six months from the date of publication.
The Data Protection Act, 2019 establishes the Office of the Data Protection Commissioner and requires every data controller or processor to process personal data lawfully, fairly and transparently, and only for an explicit and legitimate purpose that is proportionate to what is collected.
A data controller or processor must register with the Data Commissioner where the prescribed threshold is met, and must not process a child's personal data unless a parent or guardian has consented and the controller has implemented a mechanism to verify the child's age. A data subject's consent may be withdrawn at any time, without affecting the lawfulness of processing already carried out before the withdrawal.
A data controller or processor may transfer personal data outside Kenya only where it has given the Data Commissioner proof of appropriate safeguards, or another condition such as the data subject's consent applies, and the Commissioner may prohibit, suspend or condition a transfer to protect data subjects' rights.
The Cabinet Secretary may prescribe that certain processing, on grounds of strategic state interest or protection of revenue, be carried out only through a server or data centre located in Kenya.
Section 35 gives every data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, unless the decision is necessary for a contract with them, authorized by a law with safeguards, or based on their consent.
Where such a decision is made, the controller must notify the data subject in writing as soon as reasonably practicable, and the data subject may then request reconsideration or a new decision not based solely on automated processing. The controller must act on that request within a reasonable time and answer in writing with the steps taken and the outcome. The Cabinet Secretary may make Regulations providing further safeguards for these decisions.
Every data subject has a right to be informed of the use of their personal data, to access it, to object to its processing, and to correction or deletion of false or misleading data. A data subject also has a right to data portability in a structured, commonly used and machine-readable format, and a controller must comply with a portability request within thirty days.
A respondent to a complaint must, within twenty-one days of the Data Commissioner's notice of the complaint, make representations and provide material or evidence in support, review the complaint with a view to resolving it to the complainant's satisfaction, or provide a response with the required information. Where a respondent takes none of those steps, the Data Commissioner proceeds to determine the complaint in accordance with the Act and the Regulations.
The Data Commissioner must communicate a determination to the parties in writing within seven days from the date of the determination. A decision of the Data Commissioner under the Regulations is binding on the parties and is enforced as an order of the Court. An enforcement notice takes effect from the date of service.
An enforcement notice is duly served when an electronic copy is sent to the concerned person's last used email address or, in the absence of an electronic address, when it is posted or physically delivered to that person's registered offices. A person may appeal to the High Court within thirty days of the date of service of the enforcement notice. A penalty notice may impose a daily fine of not more than ten thousand shillings for each breach identified until the breach is rectified.
The Data Commissioner enforces or takes action to recover a penalty once the period specified in the penalty notice for payment has lapsed, on the final determination of any appeal against the penalty notice, or on the lapse of the period given to appeal. The Regulations were published in the Kenya Gazette on and commenced that day.
A data subject may complain to the Data Commissioner, who may issue a penalty notice and, on appeal, be reviewed by the High Court. A person who suffers damage from a contravention of the Act is entitled to compensation from the controller or processor. Unlawful disclosure of personal data and giving false or misleading information to the Data Commissioner are separate criminal offences, and any other contravention with no specific penalty carries a general criminal penalty.
Sensitive personal data, defined to include biometric data, genetic data, health status and several other categories, may only be processed on a specific permitted ground: legitimate not-for-profit activity with appropriate safeguards, data manifestly made public by the data subject, or necessity for a legal claim or to protect vital interests. Health data may only be processed by or under a health-care provider or a person bound by professional secrecy.
The Data Commissioner may prescribe further categories of sensitive personal data and the grounds on which they may be processed.
Kenya has no scraping-specific statute, so general law governs each dimension separately. The Computer Misuse and Cybercrimes Act, 2018 criminalises unauthorised access to a computer system, but section 14 requires infringing a security measure to gain access, so scraping a public, unauthenticated page without defeating an access control does not fit a plain reading of that requirement, and no reported case has tested the point.
No Kenyan court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper. The Copyright Act, 2001 permits fair dealing for scientific research, private use, criticism or review, and the reporting of current events, and gives a right to quote, but Kenya has not enacted a text-and-data-mining exception, so training a model on scraped copyrighted text rests only on the general fair-dealing ground if it can be characterised as scientific research.
Kenya's copyright statute confers no sui generis database right, and its related rights cover only broadcasts, sound recordings and performances.
The Data Protection Act, 2019 applies to personal data without a general carve-out for information that is publicly accessible, so scraping personal data from a public Kenyan website remains subject to the Act's lawful-basis, purpose-limitation and cross-border-transfer duties, and a narrower processing ground exists only for sensitive personal data the data subject has manifestly made public.
No Kenyan statute or reported case establishes a scraping-specific unfair-competition, misappropriation or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.
Section 14 prohibits causing a computer system to perform a function, by infringing a security measure, with intent to gain access, knowing the access is unauthorised, and defines access broadly to include copying, transferring, altering or outputting data. The offence carries a fine of up to KES 5,000,000 or imprisonment of up to three years, or both.
Because the offence's trigger is infringing a security measure, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.
Kenya's Computer Misuse and Cybercrimes Act, 2018 (Act No. 5 of 2018, Cap. 79C) sets a general cyber-incident reporting duty, in section 40, on any person who operates a computer system or a computer network in Kenya, whether public or private: within twenty-four hours of an attack, intrusion, or other disruption to the functioning of another computer system or network, the operator must inform the National Computer and Cybercrimes Co-ordination Committee, and failing to do so is itself an offence carrying a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both.
Because that duty binds any operator of a computer system rather than a licensed or sector-specific status, it reaches an ordinary developer operating a website, app, or online service with a Kenya nexus, and the row is filed and flagged on that basis.
Separately, Part II of the same Act (sections 4 through 13) creates Kenya's critical-information-infrastructure regime: the Director of the Committee designates, by Gazette notice, which systems are "critical infrastructure", meaning a system whose disruption would have the effects section 9(2) lists, among them interrupting a life-sustaining service, harming the economy, causing massive casualties, disrupting the money market and severely affecting national security; only the owner or operator of a system so designated carries the Act's further critical-infrastructure duties, including an annual compliance report and audit under section 13, with a penalty on conviction of a fine of up to two hundred thousand shillings or imprisonment of up to five years, or both, for an owner who fails to file or cooperate.
The Computer Misuse and Cybercrime (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice No. 44 of 2024) operationalise that regime: an owner of designated critical information infrastructure must conduct an annual cyber-risk assessment and business impact analysis, submit a risk register to the Committee, designate a Chief Information Security Officer, and report a cybersecurity incident to the relevant Sectoral Cybersecurity Operations Centre within twenty-four hours of becoming aware of it.
The State Corporations (National Cybersecurity Agency) Order, 2026 (Legal Notice No. 89 of 2026, in effect from ) separately establishes a new National Cybersecurity Agency as the autonomous body coordinating national cybersecurity policy and auditing the cybersecurity resilience of designated critical information infrastructure; its own text creates no duty running to an undesignated private business, so it is named here as background rather than filed as an instrument.
No enacted Kenyan statute sets security requirements a software product or connected device must meet before or after it is placed on the market.
No general reasonable-security or information-security-programme statute reaches a business simply because it holds personal data; the nearest analogue is the Data Protection Act, 2019 sections 41 and 42, the technical-and-organisational-measures duty inside that comprehensive regime, an article this jurisdiction's privacy row already researches, the same architecture as General Data Protection Regulation (GDPR) Article 32, so it is not repeated here.
The same Act's breach-notification duty, section 43 (notice to the Data Commissioner within seventy-two hours and to the affected data subject), is likewise this jurisdiction's privacy-topic finding rather than restated here. No published enforcement record specific to section 40 is confirmed in the primary text. The Virtual Asset Service Providers Act, 2025 requires a licensee to have appropriate and effective cyber security measures.
The Virtual Asset Service Providers Act, 2025 requires a licensee's chief executive officer to notify the relevant regulatory authority in writing where a cyber-security incident has occurred. The Virtual Asset Service Providers Regulations, 2026 require a licensee to have in place cybersecurity measures for managing cybersecurity and operational risks.
The Virtual Asset Service Providers Regulations, 2026 require a licensee to notify the relevant regulatory authority within twenty-four hours of discovering a cybersecurity incident. Section 13(1) of the Computer Misuse and Cybercrimes Act, 2018 requires the owner or person in control of a critical information infrastructure to submit a compliance report to the Committee every year.
Section 11(1) of the Computer Misuse and Cybercrimes Act, 2018 requires the owner or operator of a system designated as critical infrastructure to report to the Committee any incidents likely to constitute a threat in the nature of an attack that amounts to a computer and cybercrime.
Regulation 31(1) of the Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 requires an owner of a designated critical information infrastructure to develop and implement an internal cybersecurity policy that is reviewed at least annually.
Regulation 65(c) of the Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 requires the owner of a critical information infrastructure to report all cybersecurity incidents to the relevant Sectoral Cybersecurity Operations Centre within twenty-four hours of becoming aware of an incident.
Regulation 35(2) of the Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 requires a licensed operator of an international or the national gateway to submit a safety standards compliance report within thirty days of a request by the Committee.
Regulation 29(3)(c) of the National Payment System Regulations, 2014 requires a payment service provider to submit to the Central Bank of Kenya, within three months of 31 December of every year, a system security audit report by a reputable independent audit firm on its payment services.
Regulation 29(2)(c) of the National Payment System Regulations, 2014 requires a payment service provider to submit to the Central Bank of Kenya, within ten days of the end of every calendar month, information regarding material service interruptions and major security breaches.
Section 9(1) of the Act requires the Director to designate certain systems as critical infrastructure by notice in the Gazette.
Section 9(2) of the Act lists, as the effects of a disruption for which the Director shall designate a system as critical infrastructure, the interruption of a life sustaining service including the supply of water, health services and energy; an adverse effect on the economy of the Republic; an event that would result in massive casualties or fatalities; failure or substantial disruption of the money market of the Republic; and an adverse and severe effect on the security of the Republic.
Section 9(4) of the Act requires the Director to issue directives that regulate the classification, protection and archiving of data held by a critical information infrastructure, its cyber security incident management, its disaster contingency and recovery measures, and the minimum physical and technical security measures it must implement.
Section 13(1) of the Act requires the owner or person in control of a critical information infrastructure to submit a compliance report to the Committee every year. An owner or authorised person in control of a critical information infrastructure who commits an offence under section 13(5) of the Act is liable on conviction to a fine of up to two hundred thousand shillings, imprisonment of up to five years, or both. The Act was published in the Kenya Gazette on , assented to on and commenced on .
Regulation 35(1) provides that the Committee shall require a licensed operator of an international or the national internet gateway to comply with the cybersecurity standards provided under the Regulations. Regulation 35(2) requires a licensed operator of an international or the national gateway to submit a safety standards compliance report within thirty days of the Committee's request.
Regulation 35(3) requires the operator to report immediately to the Committee on the connection status of the congested route, specifying the solutions for the congestion, in the event of internet traffic congestion or suspicious activity.
Regulation 35(5) provides that, where the operator fails to comply, the Committee shall in consultation with the sector Regulator recommend the restriction, suspension or revocation of the operator's license or take any other action in accordance with the relevant laws. The Regulations were published in the Kenya Gazette on and commenced on .
Regulation 2 defines critical information infrastructure as a system designated pursuant to section 9 of the Act. Regulation 5 applies the Regulations to cyber security matters in the public sector and the private sector, including the owners of critical information infrastructure. Regulation 29(1) requires an owner of a critical information infrastructure to implement the Director's directives within the time specified in the notice the Director issues.
Regulation 31(1) requires an owner of a designated critical information infrastructure to develop and implement an internal cybersecurity policy that is reviewed at least annually, to implement the directives issued under regulation 20 and to appoint or designate a Chief Information Security Officer.
Regulation 31(2) requires the owner to adopt technical and organizational measures that include an annual cybersecurity risk assessment, annual cybersecurity internal audits, a cybersecurity risk register and cybersecurity exercises and drills. Regulation 32(1) requires an owner of critical information infrastructure to designate or appoint a Chief Information Security Officer.
Regulation 33 provides that a person is qualified as a Chief Information Security Officer if the person is a citizen of Kenya, has at least five years of demonstrable professional experience in the protection of critical information infrastructure and satisfies the other conditions it lists.
Regulation 34(1) requires an owner of a critical information infrastructure, within six months from the commencement of the Regulations, to formulate, and then review and update on an annual basis, organizational policies, procedures and codes of practice to ensure the protection, preservation and management of the critical information infrastructure.
Regulation 28 requires an owner of a critical information infrastructure to ensure that the infrastructure on which critical information is domiciled is located in Kenya, and an owner who intends to have critical information located outside Kenya must apply to the Committee in Form CMCA 3.
Regulation 42(1) requires an owner of a critical information infrastructure to establish a disaster recovery and backup site located in a different location from the main location of the critical information infrastructure. Regulation 46(2) requires the compliance report an owner submits to the Director to contain a risk assessment and the owner's risk register.
Regulation 21(1) requires the Director, where an owner has failed to implement the directives by the expiry of the timelines, to issue a notice to show cause to the owner. Regulation 21(3) lists the actions that may follow, which include a report on non-compliance to the National Security Council, a recommendation to the sector Regulator to impose specifications, and a recommendation that law enforcement agencies investigate. The Regulations were published in the Kenya Gazette on and commenced on .
Regulation 27(1) requires a payment service provider to establish adequate operational arrangements for its payment services. Regulation 27(2)(d) provides that those arrangements include measures to ensure safety, security and operational reliability of the service including contingency arrangements.
Regulation 29(3)(c) requires a payment service provider to submit to the Bank, within three months of 31 December of every year, a system security audit report by a reputable independent audit firm on its payment services. In the Regulations, the Bank means the Central Bank of Kenya.
Regulation 57 allows the Bank, where no specific penalty is prescribed, to impose monetary fines not exceeding one million shillings on a payment service provider, a trustee, an agent or a cash merchant for failure to comply with the Regulations. Regulation 10(1)(e) allows the Bank to suspend or revoke a payment service provider's authorisation if the provider fails to comply with any condition of the authorisation or any applicable Law. The Regulations were published in the Kenya Gazette on and commenced on the same day.
Section 28(1) of the Act requires a licensee to have appropriate and effective cyber security measures as prescribed or as provided for under the Computer Misuse and Cybercrimes Act. Section 24(k) of the Act requires every virtual asset service provider to plan for business continuity and disaster recovery in the event of an incident or a disaster.
Where a licensee contravenes section 28 of the Act, the relevant regulatory authority must take the enforcement action it considers necessary under section 39 of the Act. The relevant regulatory authorities under the Act are the Capital Markets Authority and the Central Bank of Kenya, together with any other public body the Cabinet Secretary designates by notice in the Kenya Gazette.
The First Schedule to the Act makes the Central Bank of Kenya the responsible authority for custodial wallet providers, payment processors and stablecoin issuance, and the Capital Markets Authority the responsible authority for exchanges, trading platforms, brokers, investment advisors, managers, offering providers and tokenization. The Act was published in the Kenya Gazette on , assented to on and commenced on .
Section 47 of the Act gives a person already providing virtual asset services one year from the commencement to comply with the Act.
Regulation 96(1) requires a licensee, pursuant to section 28(1) of the Act, to have in place cybersecurity measures for the establishment and maintenance of appropriate systems and controls for managing cybersecurity and operational risks. Regulation 96(3) requires a licensee to ensure that there is a chief information security officer or the equivalent with oversight over its cybersecurity systems.
Regulation 96(4) requires a licensee to review its cybersecurity strategy and policy regularly, and at least annually. Regulation 97(4) requires a licensee's systems and controls to include vulnerability assessment, risk assessment and penetration testing on a bi-annual basis during the first year of licensing and at least once a year for subsequent years.
Regulation 97(5) requires a licensee, subject to the approval of the relevant regulatory authority, to appoint a qualified independent party to audit its systems and control as and when the authority requires. Regulation 21 requires a licensee to develop and maintain formalised business continuity and incident response plans approved by its board of directors. Regulation 21(3) requires a licensee to annually review and test its business continuity and incident response plans.
Regulation 100 requires a cybersecurity audit report to be prepared by a fit and proper person responsible for cyber security audit. The Regulations were published in the Kenya Gazette and commenced on .
Section 11(1) of the Act requires the owner or operator of a system designated as critical infrastructure to report to the Committee any incidents likely to constitute a threat in the nature of an attack that amounts to a computer and cybercrime, and the action the owner or operator intends to take to prevent the threat.
Section 11(2) of the Act requires the National Security Council to provide technical assistance to the owner or operator to mitigate the threat once the Committee receives a report. Section 11(3) of the Act allows the Director to institute an investigation of a computer and cybercrime attack on the Director's own volition and to take necessary steps to secure any critical infrastructure without reference to the entity. The Act was published in the Kenya Gazette on , assented to on and commenced on .
Any person who operates a computer system or a computer network in Kenya, whether public or private, must immediately inform the National Computer and Cybercrimes Co-ordination Committee of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
The report must include a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance delaying their notification. The Committee may propose isolating a suspected system pending resolution. Failing to report under this duty is itself an offence, punishable by a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both.
Regulation 65(c) requires the owner of a critical information infrastructure to report all cybersecurity incidents to the relevant Sectoral Cybersecurity Operations Centre within twenty-four hours of becoming aware of an incident. Regulation 65(a) and (b) require the owner to facilitate investigations by law enforcement agencies and to report and mitigate the impact of the incident in accordance with the cybersecurity standards formulated by the Committee.
Regulation 11(1) deems the Regulator of the specific Sector in which the critical information infrastructure is domiciled, or where applicable the relevant Ministry, to be the Sector Cybersecurity Operation Centre. The Regulations were published in the Kenya Gazette on and commenced on .
Regulation 29(2)(c) requires a payment service provider to submit to the Bank, within ten days of the end of every calendar month, information regarding material service interruptions and major security breaches. In the Regulations, the Bank means the Central Bank of Kenya.
Regulation 57 allows the Bank, where no specific penalty is prescribed, to impose monetary fines not exceeding one million shillings on a payment service provider, a trustee, an agent or a cash merchant for failure to comply with the Regulations. Regulation 10(1)(e) allows the Bank to suspend or revoke a payment service provider's authorisation if the provider fails to comply with any condition of the authorisation or any applicable Law. The Regulations were published in the Kenya Gazette on and commenced on the same day.
Section 25(1) of the Act requires the chief executive officer of a licensee to notify the relevant regulatory authority in writing where the chief executive officer becomes aware or has reason to believe that a cyber-security incident has occurred. Section 25(2) of the Act requires the licensee to furnish the relevant regulatory authority with a written report setting out the particulars of the situation within seven working days of providing the notification.
Where a person contravenes section 25 of the Act, the relevant regulatory authority must take the enforcement action it considers necessary under section 39 of the Act. The relevant regulatory authorities under the Act are the Capital Markets Authority and the Central Bank of Kenya, together with any other public body the Cabinet Secretary designates by notice in the Kenya Gazette.
The First Schedule to the Act makes the Central Bank of Kenya the responsible authority for custodial wallet providers, payment processors and stablecoin issuance, and the Capital Markets Authority the responsible authority for exchanges, trading platforms, brokers, investment advisors, managers, offering providers and tokenization. The Act was published in the Kenya Gazette on , assented to on and commenced on .
Section 47 of the Act gives a person already providing virtual asset services one year from the commencement to comply with the Act.
Regulation 99(1) requires a licensee that discovers a cybersecurity incident as a result of a cybersecurity event to notify the relevant regulatory authority within twenty-four hours of such discovery.
Regulation 99(2) requires the licensee to provide a detailed report within five working days on whether the cybersecurity incident affects services or systems supporting critical or important functions, affects services it is authorised to provide, or constitutes malicious and unauthorized access to its network and information systems. Regulation 99(4) requires a licensee to report any material cybersecurity incident, loss of keys, or unauthorised transaction within twenty-four hours.
Regulation 26(2) requires a licensee to submit to the relevant regulatory authority, monthly and by the tenth day of the following calendar month, a report that includes material service interruptions and major security breaches.
The Regulations define a cybersecurity incident as an occurrence that jeopardizes without lawful authority the integrity, confidentiality, or availability of information or an information system, or that constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use of policies. The Regulations were published in the Kenya Gazette and commenced on .
Kenya has not enacted a law that specifically imposes age-verification duties on adult-content services, social media platforms or app stores, and has no age-appropriate design code enacted as a statute. Regulation 9 of the Kenya Information and Communications (Consumer Protection) Regulations, 2010 requires communications licensees to give parents and guardians a way to block children's access to harmful content.
The Communications Authority's Industry Guidelines for Child Online Protection and Safety, made under those regulations, ask every ICT provider whose services children may access to implement age-verification mechanisms without prescribing a method, but the regulations penalize breaches of the regulations, not of guidelines, so the guidelines are listed as guidance on regulation 9 rather than as a law.
Separately, the Data Protection Act, 2019 requires a data controller or processor to obtain a parent or guardian's consent and to implement an age-verification mechanism before processing a child's personal data, a general data-protection duty rather than a platform-specific age-gating regime.
Regulation 9(1) requires every licensee under the Kenya Information and Communications Act to establish mechanisms that enable parents and legal guardians to block children's access to harmful content, and regulation 9(2) makes it an offence for a licensee to promote or market alcohol, tobacco or other harmful substances to children.
An offence under the Regulations with no specific penalty carries a fine of up to three hundred thousand shillings, imprisonment of up to three years, or both (regulation 23(2)). Regulation 21 lets the Commission (now the Communications Authority of Kenya) issue guidelines for implementing the Regulations; the Communications Authority's Industry Guidelines for Child Online Protection and Safety are such guidelines and are listed with this regulation as guidance.
Kenya has no press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no reported hot-news or misappropriation doctrine, and no linking or framing case law reaching a news aggregator.
The general exception available to an aggregator is the Copyright Act, 2001's fair-dealing and quotation exception, which permits reproduction for scientific research, private use, criticism or review, and the reporting of current events, and gives a standalone right to quote, but Kenya has not enacted a machine-readable text-and-data-mining opt-out, so an aggregator's indexing is not addressed by any text and data mining (TDM)-specific rule either way.
The exclusive rights of a copyright owner under section 26 do not include the right to control fair dealing for the purposes of scientific research, private use, criticism or review, or the reporting of current events, doing any of those acts by way of parody, pastiche or caricature, or a standalone right to quote a work. The exception requires the source of the reproduced work to be sufficiently acknowledged.
No current case law for Kenya content moderation law
No current case law for Kenya product and AI liability law
No current case law for Kenya digital accessibility law
No current case law for Kenya age gating law
No current case law for Kenya reuse law
Reporting clocks that run here5 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Kenya comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
Report all cybersecurity incidents to the relevant Sectoral Cybersecurity Operations Centre within twenty-four hours of becoming aware of an incident (regulation 65(c)). The Regulator of the specific Sector in which the infrastructure is domiciled or, where applicable, the relevant Ministry is the Sector Cybersecurity Operation Centre (regulation 11(1)).
Notify the relevant regulatory authority within twenty-four hours of discovering a cybersecurity incident that results from a cybersecurity event, which is any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse your electronic systems or the information stored on them (regulation 99(1)).
Provide a detailed report within five working days on whether the incident affects the services or network and information systems that support your critical or important functions, affects services you are authorised to provide, or is a malicious and unauthorized access to your network and information systems, including the remedial actions to mitigate it and prevent future events (regulation 99(2) and (3)).
Report any material cybersecurity incident, loss of keys, or unauthorised transaction within twenty-four hours (regulation 99(4)).
Notify the Data Commissioner within seventy-two hours of becoming aware of a personal data breach that carries a real risk of harm, giving reasons if you notify later.
As a data processor, notify the data controller within forty-eight hours of becoming aware of a breach where reasonably practicable, and otherwise without delay (section 43(3)).
Within seven working days of providing that notification, furnish the relevant regulatory authority with a written report setting out the particulars of the situation and the mitigating measures you will undertake (section 25(2)).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
