Data Centres and Digital Infrastructure Investment in Kenya

Kenya already functions as a regional data centre location. Three things explain it: the Mombasa cable gateway, a government that now regulates data centres as infrastructure in their own right, and an ownership regime that no longer requires local equity in ICT companies.

Connectivity. When the PEACE cable landed at Nyali, Mombasa, in March 2022, the Kenya News Agency reported it as the sixth international submarine cable to land in Kenya, alongside TEAMS, EASSy, LION, SEACOM and DARE1. PEACE was reported at 192 Tbps of design capacity on a route linking Pakistan, Kenya, Egypt and France, extended to Singapore. Landing density of this kind is the main reason operators place regional capacity in Kenya.

Government capacity. The Konza National Data Centre, owned by the Konza Technopolis Development Authority, holds Uptime Institute Tier III certification for both its design documents and the constructed facility, and offers cloud services to government and enterprises.

Ownership. By Gazette Notice No. 11079 of 22 August 2023 the Cabinet Secretary for ICT deleted the 30% local shareholding requirement from the National ICT Policy Guidelines 2020, with immediate effect. A foreign investor can therefore own a Kenyan data centre company outright, without a local equity partner. The same Guidelines direct government to “promote, encourage and license private sector investment in neutral data centres by companies incorporated for that purpose”, a policy the Communications Authority cites as the basis for licensing the sector.

Section 24(1) of the Kenya Information and Communications Act 1998 prohibits operating a telecommunication system or providing telecommunication services without a licence. The Communications Authority of Kenya (CA) applies that rule to commercial data centres through its Telecommunications Market Structure, which it revised in 2026.

The position today

Under the 2026 Market Structure, data centres are licensed in the Network Facilities Provider Tier 2 (NFP-T2) category. Holders of an NFP-T1 or NFP-T2 licence may establish commercial data centres without any further licence. The lower tiers do not help: the Micro Network and Service Provider and Community Network licences expressly exclude data centres.

Each application also carries a KES 5,000 application fee. Universal Service Fund contributions are charged separately under section 84J of the Act, currently at 0.5% of annual gross revenue from licensed services.

The proposed standalone licence

In September 2026 the CA published a Proposed Licensing Framework for Data Centres for 30 days of public comment. Its reasoning is that colocation facilities provide hosting, power, cooling and computing, but do not transmit signals, use spectrum or serve subscribers, so the NFP regime over-regulates them. The proposal:

Whichever licence applies, the order is the same: incorporate the operating company, obtain county development permission for the building (Chapter IV), then apply to the CA before offering colocation, hosting or network services to third parties.

A colocation operator is rarely the data controller for what its customers store, but it is usually a data processor, and it controls its own staff, visitor and CCTV data. The Data Protection Act 2019 and three sets of 2021 Regulations govern both roles.

Registration with the ODPC

Section 18 of the Act requires data controllers and processors to register with the Office of the Data Protection Commissioner (ODPC). Under regulation 13 of the Registration Regulations 2021, an entity is exempt only if it has both an annual turnover below KES 5 million and fewer than ten employees. The exemption does not apply to anyone processing for a purpose listed in the Third Schedule, which includes “telecommunications network or service providers” and security CCTV systems. A licensed data centre will almost always fall within one of those, so it should plan to register whatever its size. Certificates are valid for 24 months.

What must stay in Kenya

The Act does not impose general data residency. Regulation 26 of the Data Protection (General) Regulations 2021 requires in-country processing only for personal data processed for strategic interests of the state, namely:

• civil registration and legal identity management systems;
• the conduct of elections;
• any system for administering public finances by a state organ;
• systems designated as protected computer systems under section 20 of the Computer Misuse and Cybercrimes Act 2018;
• early childhood and basic education under the Basic Education Act 2013;
• primary or secondary health care.

For those purposes the data must be processed through a server and data centre located in Kenya, or at least one serving copy must be stored in a Kenyan data centre. Regulation 26(3) also lets the Cabinet Secretary extend the requirement to a controller processing abroad that fails to deal with a breach or obstructs the Data Commissioner.

Transfers abroad

Under regulation 40, before personal data leaves Kenya the transferring entity must establish one of four bases: appropriate safeguards (regulations 41 to 43, including binding corporate rules), an adequacy decision of the Data Commissioner (regulation 44), necessity for a purpose listed in section 48(c) of the Act (regulation 45), or the data subject’s explicit consent after being told of the risks (regulation 46). Sensitive personal data needs consent under section 49 of the Act.

At the planning and environmental level a data centre is a large industrial-scale building with heavy power, cooling and fuel storage. It is screened accordingly.

County development permission

Under section 57 of the Physical and Land Use Planning Act 2019, no development may be carried out within a county without development permission from the county executive committee member. Starting without it is an offence punishable by a fine of up to KES 500,000, imprisonment of up to two months, or both, and the county must order the land restored within 90 days. Other points that matter for a data centre:

• If the applicant receives no written response within 60 days, permission is assumed to have been given (section 58(6)).
• Permission is subject to compliance with every other written law (section 58(5)), so it does not replace the environmental licence.
• A licensing authority may not license the commercial or industrial use or occupation of a building that lacks development permission (section 66). The Act defines industrial use to include power generation and warehousing and storage.
• The Third Schedule lists the siting of power generation plants and factories among development control matters, and requires environmental and social impact assessment for major developments.

The practical effect is that planning comes first. Ask the county planning department early how it will treat the on-site generation plant and fuel storage.

NEMA environmental licence

Projects listed in the Second Schedule to the Environmental Management and Co-ordination Act need an Environmental Impact Assessment (EIA) licence from the National Environment Management Authority (NEMA) before they start. NEMA states that it acknowledges complete applications within seven days and issues licences within 45 to 90 days under the EIA and Audit Regulations 2003, and advises applying at least three months before work begins. A data centre’s power, cooling and fuel storage make the longer end of that range the realistic planning assumption.

On a facility costing KES 2 billion, the 0.1% fee alone is KES 2 million, so it belongs in the capital budget rather than in sundry costs.

Power decides whether a data centre is bankable. It runs on two separate tracks: the grid supply and any on-site generation.

Grid supply. A facility buying power from Kenya Power under a supply agreement does not need its own generation licence; Kenya Power holds the distribution and supply licence. At data centre loads, substation capacity and any dedicated feeder are scheduling issues as much as legal ones, so open the discussion with Kenya Power at site selection stage.

On-site and standby generation. Section 117 of the Energy Act 2019 requires a licence from the Energy and Petroleum Regulatory Authority (EPRA) to generate electricity, with a proviso that no authorisation is needed to generate for own use at a capacity not exceeding one megawatt. Standby generation that carries IT and cooling load during outages is generation for own use, and at any meaningful scale its aggregate capacity will exceed one megawatt. On the text of section 117, that plant needs EPRA authorisation.

Diesel storage for standby generation also needs to be scoped with NEMA (Chapter IV) and the county’s fire and petroleum storage requirements while the mechanical design is still open.

We have found no tax incentive written specifically for data centres in Kenya. A data centre investor uses the same tools as any capital-intensive project: the standard regime with capital allowances, or Special Economic Zone (SEZ) status.

Standard regime. Resident companies, and Kenyan branches of foreign companies, pay corporate income tax at 30%. Capital expenditure is relieved through the capital allowances in the Second Schedule to the Income Tax Act; the rate depends on how each asset is classified (building, machinery, telecommunications equipment or computer hardware), and that classification should be settled with a tax adviser before the financial model is closed.

SEZ status. Section 4 of the Special Economic Zones Act 2015 lets the Cabinet Secretary declare information communication technology parks as SEZs, and a licensed SEZ enterprise, developer or operator pays corporate income tax at 10% for the first ten years and 15% for the next ten. Section 35 of the Act adds:

• exemption from stamp duty on instruments relating to the zone business;
• exemption from county advertisement and business service permit fees;
• work permits for up to 20% of full-time employees, with more available for specialised sectors on the SEZ Authority’s recommendation;
• other tax incentives as set out in the tax statutes.

Our separate guide to Special Economic Zones and manufacturing incentives covers SEZ licensing in more depth.

The Kenya Investment Authority (KenInvest) is the practical front door for a foreign-owned project. A foreign investor proposing an investment of at least USD 100,000 (KES 1,000,000 for a local investor) can apply for an Investment Certificate.

KenInvest assesses the project against job creation, skills and technology transfer, tax revenue, foreign exchange, use of local inputs and the use and development of ICT, criteria on which a data centre usually scores well. The certificate is not a sector licence and does not replace the CA licence or the NEMA approval. Its value is that, once issued, the investor can move on to work permit and KRA PIN applications on the strength of it.

Because the ICT local shareholding rule has gone (Chapter I), the same foreign-owned company can hold the Investment Certificate and the CA licence directly. There is no need for the two-entity structures used where land rules restrict foreign ownership.

Two things separate data centre construction from an ordinary commercial build: sequencing against the approvals in Chapters II, IV and V, and the technical standard the facility will be judged against.

Sequencing

Development permission and the EIA licence come first, then detailed design and procurement, then the CA licence application. Construction can start once planning and environmental approvals are in place; it need not wait for the CA licence. Order generators, UPS systems and switchgear against the EPRA step in Chapter V, since import lead times on this equipment often run longer than the licensing.

The Government Data Centre Standard

The ICT Authority’s Government Data Centre Standard (ICTA.2.2.002:2023, third edition, effective 1 July 2023) applies to the national government, county governments, constitutional commissions and state corporations. It does not bind a private operator directly, but it reaches the operator through procurement: data centres holding public data must be at least Tier 2 as defined in the Standard, and the supplier’s service level agreement must guarantee at least 99.99% availability. An operator targeting public sector customers should design to it.

Contract protections

Construction and equipment contracts of this size should carry performance security tied to commissioning milestones, defects liability periods matched to manufacturer warranties on power and cooling plant, and a clear allocation of the risk of import and customs delay on specialised equipment.

Day-to-day headcount is small, but the roles that matter most early on, such as mechanical and electrical leads, network operations specialists and security architects, are often filled by non-citizens.

The usual route is the Class D (employment) permit. The Directorate of Immigration’s fees, revised by Gazette Notice No. 15493 of 14 November 2023 with effect from 1 January 2024, are:

The Directorate’s 2024 Service Delivery Charter sets a service standard of 21 working days for a work permit decision and 10 for a renewal. In practice, incomplete files take much longer, so start as soon as a candidate is identified.

ICT Authority clearance. Immigration refers some ICT-sector applicants to the ICT Authority for a no-objection letter before it decides. The Authority aims to respond within 14 working days of a complete application. It expects evidence that the role was advertised locally without a suitable Kenyan candidate, the CV of the Kenyan understudy who will be trained, and, on renewal, evidence of why the understudy cannot yet take over.

For permit categories and documents, see our Work Permit Navigator.

Separate from CA licensing and from data protection, the Computer Misuse and Cybercrimes Act 2018 and the Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations 2024 (L.N. 44 of 2024) set up a regime for critical information infrastructure (CII), overseen by the National Computer and Cybercrimes Coordination Committee.

How a system becomes CII

Designation is not automatic. The Committee approves the identification of CII and submits its recommendations to the National Security Council; the Director then designates the system by notice in the Gazette (regulations 6, 22 and 24). An operator can therefore check whether its systems, or a customer’s systems in its halls, have been designated.

Duties once designated

• Localisation: the infrastructure on which critical information is held must be located in Kenya; storage abroad needs an application on Form CMCA 3, decided within 30 days after consulting the National Security Council (regulation 28).
• Annual assessment: an annual cyber-risk assessment and business impact analysis, with the risk register submitted to the Committee through the Director (regulation 17).
• Incident reporting: every cybersecurity incident reported to the relevant Sectoral Cybersecurity Operations Centre within 24 hours of becoming aware of it (regulation 65), with reports to the Committee on Form CMCA 7 (regulation 66).

These duties sit beside the data protection duties in Chapter III. One incident at a designated facility can require a 24-hour cybersecurity report, a 48-hour notice from the operator to its customers, and the customers’ 72-hour notices to the Data Commissioner. Build one incident response plan that meets all three clocks.

The approvals in Chapters II to X, in the order worth confirming before capital is committed to a site or a design.

1. Choose the CA licence route

   Budget for NFP-T2 today, and track the CA’s standalone data centre licence before fixing a long-term licensing cost.

2. Secure county development permission first

   Section 66 of the Physical and Land Use Planning Act bars licences for the commercial or industrial use of an unapproved building. Raise the generation plant and fuel storage with the county early.

3. Budget for the NEMA EIA licence

   Allow up to 90 days and 0.1% of total project cost, with no cap.

4. Lock in power

   Confirm grid capacity with Kenya Power at the site, and whether standby plant above one megawatt needs EPRA authorisation under section 117 of the Energy Act.

5. Register with the ODPC

   Plan to register regardless of size, and confirm the fee band before operations begin.

6. Screen target customers against regulation 26

   Identify which customers’ data falls within the strategic-interest categories and design Kenya-located primary or serving-copy storage for them.

7. Compare SEZ status with a standard company

   Model the 10% and 15% SEZ rates against the ten-year cap in section 35(5), and against standard capital allowances.

8. Apply for the KenInvest Investment Certificate

   Confirm the USD 100,000 threshold is met and apply early; later permit and PIN steps rely on it.

9. Start specialist work permits early

   Prepare the understudy plan and local advertisement evidence for any ICT Authority referral, and allow for the KES 500,000 annual issuance fee per permit.

10. Check CII designation and build one incident plan

    Check whether any system in the facility is gazetted as critical information infrastructure, and design incident response around the 24-hour, 48-hour and 72-hour clocks.

Primary sources first. Press and law firm commentary is marked as such and used only to locate a primary source or where none was available.

1. Communications Authority of Kenya, Telecommunications Market Structure 2026 (NFP-T1, NFP-T2 and other licence categories and fees)Primary
2. Communications Authority of Kenya, Transitional Provisions for the Revised Market StructurePrimary
3. Communications Authority of Kenya, Proposed Licensing Framework for Data Centres, consultation version (September 2026)Primary
4. Data Protection Act No. 24 of 2019, sections 18, 43, 48, 49 and 50Primary
5. Data Protection (General) Regulations 2021, regulations 26 and 40 to 47Primary
6. Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021, regulation 13 and Second and Third SchedulesPrimary
7. Physical and Land Use Planning Act No. 13 of 2019, sections 57, 58, 66 and Third Schedule (Kenya Gazette Supplement text)Primary
8. NEMA, Environmental licensing: EIA timelines and feePrimary
9. NEMA, Reinstatement of environmental impact assessment and related fees (effective 1 June 2022)Primary
10. Energy Act No. 1 of 2019, section 117Primary
11. Special Economic Zones Act (Cap. 517A), sections 4 and 35, Kenya Law revision as at 27 December 2024Primary
12. Kenya Revenue Authority, Investment Certificate: thresholds and KenInvest criteriaPrimary
13. ICT Authority, Government Data Centre Standard ICTA.2.2.002:2023 (third edition)Primary
14. Directorate of Immigration Services, Service Delivery Charter 2024 (permit charges and timelines)Primary
15. ICT Authority, clearance for ICT work permit applicantsPrimary
16. Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations 2024, L.N. 44 of 2024Primary
17. Uptime Institute, Konza National Data Center Tier III awardsPrimary
18. Kenya News Agency, PEACE submarine cable lands in Mombasa (March 2022)Press
19. PwC Worldwide Tax Summaries, Kenya corporate tax rates (reviewed 17 July 2026)Commentary
20. Bowmans, Cabinet Secretary removes local equity requirement for ICT sector players (Gazette Notice No. 11079 of 2023)Law firm
21. Clyde & Co, Review of immigration charges and fees (Gazette Notice No. 15493 of 2023)Law firm
22. Nation, EPRA tightens rules for own-use power generation (Statute Law (Miscellaneous Amendments) Bill 2023)Press

Spotted something out of date? Tell us