Data protection
The Data Protection Act 2019, modelled closely on the GDPR, is enforced by a Commissioner's office that has issued penalty notices.
Protection rests on the Data Protection Act 2019, closely modelled on the GDPR and enforced by the Office of the Data Protection Commissioner. The ODPC has been notably active, issuing penalty notices including against digital lenders that misused borrowers' phone contacts.
Key points
| Regulator | Office of the Data Protection Commissioner |
|---|---|
| Penalty notices | Capped by reference to turnover, and actively issued |
| Digital lending | A major enforcement focus, with penalties against lending apps |
| Data protection officers | Required for certain categories of organisation |
In practice
- Complain online to the Office of the Data Protection Commissioner: it is free and responsive.
- For lending app harassment, cite the data protection breach as well as the conduct.
Worth knowing
Digital lending apps that contact a borrower's phone contacts have been penalised repeatedly. That practice is a data protection breach, not merely aggressive collection.
The general article: Data protection · Compare with another country
Privacy
Article 31 of the 2010 Constitution protects privacy, including of communications and of information relating to family or private affairs. The Data Protection Act 2019 created the Office of the Data Protection Commissioner, which has become one of the more active regulators on the continent, issuing enforcement and penalty notices.
Key points
| Constitution | Article 31, expressly covering communications and personal information |
|---|---|
| Statute | Data Protection Act 2019, with registration of controllers and processors |
| Regulator | Office of the Data Protection Commissioner, free complaints |
| Registration | Mandatory for many controllers and processors above thresholds |
| Penalties | Penalty notices capped by reference to turnover |
| Court | High Court petition under Article 22 for constitutional violations, without fees |
| Article 22 petitions | No filing fee, and open standing |
| Damages | Courts have awarded compensation for unlawful disclosure of personal data |
| Digital lending | A major enforcement focus for the Commissioner |
In practice
- File an Article 22 petition where a public body is involved: there is no filing fee.
Where to go
- High Court constitutional petition under Article 22.
Worth knowing
Article 22 petitions carry no filing fee and can be brought by anyone, including on behalf of someone unable to act: it is an unusually open door. Kenya combines an active regulator with free constitutional petitions. Using both at once is common and effective.
Image rights
Section 37 of the Computer Misuse and Cybercrimes Act 2018 makes it an offence to transfer, publish or disseminate an intimate image without consent. Cyber harassment is separately criminalised, and the Data Protection Act applies where the image is personal data. Constitutional privacy protection under Article 31 sits behind all of it.
Key points
| Statute | Computer Misuse and Cybercrimes Act 2018, section 37 |
|---|---|
| Cyber harassment | Separate offence covering menacing and indecent communication |
| Data protection | Data Protection Act 2019 for identifiable images |
| Constitution | Article 31 protects privacy of communications and personal information |
| Reporting | DCI cybercrime unit and the national KE-CIRT coordination centre |
| Civil claim | Constitutional petition under Article 22, no filing fee |
| Section 37 | Distribution of intimate images without consent is a specific offence |
| Constitutional petition | Available in parallel, with no filing fee |
In practice
- Run the criminal report and the data protection complaint at the same time.
Where to go
- DCI Cybercrime Investigation Unit.
Worth knowing
Both the criminal and the constitutional routes are open at once: an Article 22 petition can be filed even while a police investigation is pending, and it costs nothing to file. Kenya is one of the few countries in the region with a specific offence for non-consensual intimate images. Cite section 37 by number when reporting.
The general article: Image rights · Compare with another country
Speech and online harassment
The Computer Misuse and Cybercrimes Act 2018 criminalises cyberharassment and false publications, while the High Court decriminalised defamation in 2017.
The framework rests on the Computer Misuse and Cybercrimes Act 2018, which criminalises cyberharassment and false publications, upheld in substantial part by the courts. Defamation was decriminalised by the High Court in 2017, leaving civil claims as the route for reputational harm.
Key points
| Criminal defamation struck down | Held unconstitutional by the High Court in 2017 |
|---|---|
| Civil defamation | Remains available, with substantial awards |
| Cyber harassment | An offence under the Computer Misuse and Cybercrimes Act |
| False publication | Provisions on false publication have been challenged in court |
In practice
- Report cyber harassment to the DCI cybercrime unit with preserved evidence.
- For reputational harm, civil defamation is the route: the criminal offence no longer exists.
Where to go
- Directorate of Criminal Investigations cybercrime unit.
- Communications Authority of Kenya.
- Article 19 Eastern Africa for free expression issues.
Worth knowing
Criminal defamation was declared unconstitutional in 2017. Police occasionally still invoke it; the decision is binding and can be cited.
The general article: Speech and online harassment · Compare with another country
Copyright
A 2019 amendment introduced a takedown notice procedure for internet service providers and clarified their liability. The Kenya Copyright Board administers the system and operates a voluntary registration service that is widely used as evidence.
Kenya's Copyright Act protects works for the author's life plus fifty years and was significantly amended in 2019 to introduce a notice-and-takedown procedure for internet service providers and to tighten the regulation of collecting societies, an area that had generated long-running disputes among musicians. The Kenya Copyright Board administers registration, which is voluntary.
Key points
| Statute | Copyright Act 2001, amended in 2019 and 2022 |
|---|---|
| Takedown | Statutory ISP notice procedure since the 2019 amendment |
| Registration | Voluntary, through the Kenya Copyright Board; useful as evidence |
| Collective management | Licensed societies, with the Board supervising tariffs |
| Fair dealing | Research, private use, criticism, review, reporting |
| Voluntary registration | Through the Copyright Board, widely used as evidence |
| ISP liability | Defined by the 2019 amendment, with a prescribed notice form |
| Tariff supervision | The Board approves collective management tariffs |
In practice
- Use the prescribed takedown notice form: an incorrectly formatted notice will be ignored.
Where to go
- Kenya Copyright Board.
- MCSK, KAMP and PRISK for music.
Worth knowing
The takedown procedure has formal requirements: a notice that does not follow the prescribed form will simply be ignored by the service provider. The notice procedure has formal requirements. Service providers are entitled to disregard a notice that does not comply.
Frequently asked questions
How does takedown work in Kenya?
The 2019 amendments created a statutory notice-and-takedown procedure: a rights holder serves a notice on the internet service provider, which must act within a set period or lose its safe harbour. There is a counter-notice route for the person who posted the material.
The general article: Copyright · Compare with another country
Identity theft
Specific offences for identity theft and impersonation, with mobile money and SIM swap the dominant risk.
Sections 28 and 29 of the Computer Misuse and Cybercrimes Act 2018 cover identity theft and impersonation. The practical risk in Kenya runs through SIM swap: control of the phone number gives control of mobile money and of bank one-time passwords. Mobile operators and banks both operate fraud reporting lines.
Key points
| Statute | Computer Misuse and Cybercrimes Act 2018, sections 28 and 29 |
|---|---|
| SIM swap | The main attack route; report an unexplained loss of signal immediately |
| Mobile money | Report to the operator's fraud line at once to attempt a reversal |
| Credit | Credit reference bureaus must provide a free report each year |
| Data protection | Report the underlying breach to the Data Protection Commissioner |
| Enforcement | DCI cybercrime unit |
In practice
- If your phone suddenly loses network for no reason, treat it as a SIM swap and call your operator immediately.
- Report to the mobile money operator's fraud line before anything else: reversals are only possible early.
- Open a case with the DCI and obtain an OB number.
- Request your credit reference bureau reports and dispute unknown loans.
Where to go
- DCI cybercrime unit.
- Mobile operator fraud lines.
Worth knowing
Digital lending apps make it easy for someone with your identity documents to take loans in your name: check all three credit reference bureaus, not just one.
The general article: Identity theft · Compare with another country
Online shopping
The Consumer Protection Act 2012 regulates distance contracts and gives cancellation rights where the supplier fails its obligations.
Protection comes from the Consumer Protection Act 2012, which regulates distance contracts and gives cancellation rights where the supplier fails to meet its obligations. Mobile money disputes are handled by the operator under the Central Bank's oversight.
Key points
| Consumer Protection Act 2012 | Covers unfair practices, warranties and online contracts |
|---|---|
| Competition Authority | Handles consumer complaints and has ordered refunds |
| Internet agreements | The Act gives cancellation rights where required information was not provided |
| Small claims court | Established to handle low-value disputes quickly |
In practice
- Use the small claims court: it is designed for speed and does not require a lawyer.
- Complain to the Competition Authority where the trader is a larger business.
Where to go
- Competition Authority of Kenya consumer protection department.
- Communications Authority for mobile money and telecom issues.
- Small claims courts.
Worth knowing
The Act allows cancellation of an internet agreement where the supplier failed to provide the required information. That is a wider right than most consumers realise.
The general article: Online shopping · Compare with another country
Romance scams
A police cybercrime unit, and mobile money reversal that works only in the first minutes.
The directorate of criminal investigations operates a cybercrime unit, and the communications authority runs a national computer incident response team. For mobile money, the operator's reversal procedure is the decisive tool: it must be triggered immediately, and it only works while the funds remain unwithdrawn.
Where to go
- Mobile money operator reversal procedure, within minutes
- National computer incident response team
- Your bank's fraud line
Sources
- DCI cybercrime unit — 0800 722 203 — toll-free, anonymous line of the Directorate of Criminal Investigations for scams, online fraud and SIM swaps
- National KE-CIRT/CC — report an incident — national computer incident response team; incidents@ke-cirt.go.ke, +254 703 042 700
- Your mobile money provider's fraud line — the fastest lever: call before the funds are withdrawn
- eConsumer.gov — international channel for scams committed from abroad
The general article: Romance scams · Compare with another country
General sources
- eCitizen — official government services portal