Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Kenya Computer Misuse and Cybercrimes Act

Amended Kenya · In force May 30, 2018 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectNov 4, 2025 · 12 months ago · Source
2025 amendments commenceComputer Misuse and Cybercrimes (Amendment) Act No. 17 of 2025: assented 15 October 2025, published 21 October 2025, commenced 4 November 2025.
Takes effectMay 30, 2018 · 8.4 years ago · Source
Act commencesAssented 16 May 2018, published 18 May 2018, commenced 30 May 2018.

Summaries for reference, not legal advice. Check the official text.

What it does

Kenya's main cybercrime law. It creates offences such as unauthorised access, interference, cyber harassment and false publication, sets up a National Computer and Cybercrimes Co-ordination Committee, and requires critical infrastructure owners to report threatening incidents. The 2025 amendment adds identity theft rules and lets the Committee order websites or apps that promote unlawful activity, child sexual content, terrorism or extremism to be blocked.

Who it applies to
Everyone in Kenya; owners and operators of designated critical information infrastructure have reporting and protection duties.
Penalties
For example, unauthorised access carries a fine up to KES 5 million or up to 3 years in prison; offences against protected systems carry up to KES 25 million or 20 years.
Enforced by
National Computer and Cybercrimes Co-ordination Committee, National Police Service and the courts
Official name
Computer Misuse and Cybercrimes Act, 2018
Citation
Act No. 5 of 2018 (Cap. 79C), amended by Act No. 17 of 2025
Topics
Cybersecurity, Online safety
Verified 2026-09-25 new.kenyalaw.org
Research notes

Kenya Law is run by the National Council for Law Reporting, a state body. Several sections of the 2018 Act were challenged in court, and Kenya Law lists a 2025 challenge (Law Society of Kenya and 8 others v Attorney General) that cites the 2025 amendment. Check current court orders before relying on the amended provisions.

Related

In forceKenya
Kenya Data Protection ActKenya's GDPR-inspired data protection law establishing the ODPC, mandatory registration of data controllers and processors, data subject rights, 72-hour breach notification to the Commissioner, DPIAs, and conditions on cross-border transfers (with some data localisation for strategic public interest processing).In effect since Nov 25, 2019
In forceSouth Africa
South Africa Cybercrimes ActCreates cybercrime offences such as unlawful access, interception, interference with data and systems, cyber fraud, extortion, and malicious communications including harmful intimate images. It also sets rules for search, seizure and cross-border cooperation. The duty for electronic communications service providers and financial institutions to report cybercrime (section 54) has not yet commenced.In effect since Dec 1, 2021
In forceUnited Arab Emirates
UAE Child Digital Safety LawSets child safety duties for internet service providers and digital platforms that operate in or target the UAE, from social media and games to e-commerce. Platforms may not process personal data of children under 13 without verifiable parental consent and must use age verification and risk-based controls. A 2026 Cabinet Resolution bars social media accounts for children under 15 and restricts accounts for 15 year olds.Next: Jan 1, 2027 Compliance deadline under the Decree by Law · in 2 months
Questions about Kenya Computer Misuse and Cybercrimes Act
What are the Kenya Computer Misuse and Cybercrimes Act compliance deadlines?
May 30, 2018: Act commences. Nov 4, 2025: 2025 amendments commence.
When does Kenya Computer Misuse and Cybercrimes Act take effect?
Kenya Computer Misuse and Cybercrimes Act took effect on May 30, 2018.
Who does Kenya Computer Misuse and Cybercrimes Act apply to?
Everyone in Kenya; owners and operators of designated critical information infrastructure have reporting and protection duties.
What are the penalties under Kenya Computer Misuse and Cybercrimes Act?
For example, unauthorised access carries a fine up to KES 5 million or up to 3 years in prison; offences against protected systems carry up to KES 25 million or 20 years.