Kenya’s Computer Misuse and Cybercrimes Act 2018: What Tech Companies Must Know

The Computer Misuse and Cybercrimes Act, 2018 (Cap 79C) is Kenya’s principal statute on cybercrime, and several of its provisions have direct consequences for technology companies and digital platforms. Getting the section numbers right matters in practice, because a compliance memo or contract indemnity that cites the wrong provision can leave a real risk unaddressed while appearing to cover it.

Key Offences Under the Computer Misuse and Cybercrimes Act

The offences sit in Part III. Under section 14, a person who causes a computer system to perform a function by infringing security measures, with intent to gain access and knowing the access is unauthorised, is liable to a fine of up to KES 5,000,000 or imprisonment for up to three years, or both. Under section 16, a person who intentionally and without authorisation does any act that causes unauthorised interference to a computer system, program or data is liable to a fine of up to KES 10,000,000 or imprisonment for up to five years, or both. Section 16 is a single offence that in practice covers conduct such as denial-of-service attacks and malware deployment.

Technology companies should also be aware that the Act’s two former false-publication offences are no longer a safe basis for content moderation policy. On 6 March 2026 the Court of Appeal, in Bloggers Association of Kenya (BAKE) v Attorney General & 6 others (Civil Appeal 197 of 2020) [2026] KECA 430 (KLR), declared those sections unconstitutional as overbroad and an infringement of freedom of expression. The Kenya Law record of the Act has not been updated to show this, so a reader of the bare statute could be misled. The Speaker of the National Assembly has since sought to appeal: on 17 July 2026 the Supreme Court allowed an application for time to file a fresh notice of appeal in Speaker, National Assembly v Bloggers Association of Kenya (BAKE) & 6 others [2026] KESC 55 (KLR). Check the current status before relying on the position in any specific decision.

Platform-Relevant Offences: Harassment, Identity Theft and Phishing

Several further Part III offences matter for a platform hosting user content or accounts. Section 27 creates the offence of cyber harassment, covering wilful communication that the person knows or ought to know is likely to cause apprehension or fear of violence, or damage to property, that detrimentally affects the recipient, or that is indecent or grossly offensive and affects the person, with a maximum fine of KES 20,000,000 or imprisonment for up to ten years, or both. A platform’s reporting and takedown process should be designed with these statutory elements in mind, since harassment as users understand it does not map exactly onto the offence.

Section 29 creates the offence of identity theft and impersonation, covering fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature, with a maximum fine of KES 200,000 or imprisonment for up to three years, or both. Section 30 creates the offence of phishing, covering creating or operating a website, or sending a message, email or call, intended to induce disclosure of personal information for an unlawful purpose or to gain unauthorised access to a computer system, with a maximum fine of KES 300,000 or imprisonment for up to three years, or both. A platform with account creation or messaging features should map its abuse-reporting and verification tools against these provisions.

Data Security Obligations

The Act operates alongside the Data Protection Act, 2019, so a security failure can create exposure under both statutes. Notifying the Data Commissioner of a breach under the Data Protection Act does not resolve separate exposure under the Computer Misuse and Cybercrimes Act arising from the same failure. Maintain access controls, encryption appropriate to the sensitivity of the data, a documented vulnerability management programme and a tested incident response procedure, as these are the evidence that appropriate security measures were in place.

Law Enforcement Cooperation

Part IV of the Act sets out investigation procedures, including search and seizure of stored computer data (section 48) and production orders (section 50). Under section 50, a police officer or authorised person who has reasonable grounds to believe that specified data, or subscriber information held by a service provider in Kenya, is necessary for an investigation may apply to court for an order, and the court may direct a specified person or service provider to submit the data. A company that receives a production order should have an internal process for verifying its validity and scope before complying, since handing over more than a valid order requires may create separate exposure under the Data Protection Act.

Corporate Liability

Section 43 provides that where an offence under the Act is committed by a body corporate, the body corporate is liable on conviction to a fine of up to KES 50,000,000. Every person who was a principal officer of the body corporate at the time, or anyone acting in a similar capacity, is also deemed to have committed the offence unless they prove that it was committed without their consent or knowledge and that they exercised the diligence they ought to have exercised, and is liable to a fine of up to KES 5,000,000 or imprisonment for up to three years, or both. Compliance programmes therefore need leadership buy-in, not just IT or legal ownership.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.