Cybersecurity law & regulation in Kenya (2026)
Cybersecurity in Kenya: comprehensive law.
Kenya has a comprehensive, horizontally-applicable cybersecurity regime built around the Computer Misuse and Cybercrimes Act, 2018, which criminalises a wide range of cyber-offences and empowers the government to designate and regulate Critical Information Infrastructure (CII). Detailed implementing rules came into force in February 2024 (LN 44/2024) and introduced mandatory CII designation, a Chief Information Security Officer requirement, annual risk assessments and a 24-hour incident-reporting duty to the National KE-CIRT/CC. The framework was further strengthened by the 2024 Amendment Act (assented October 2025, now under constitutional challenge) and by the establishment of the National Cybersecurity Agency (NCSA) via Legal Notice 89 of 2026.
Legal framework
Computer Misuse and Cybercrimes Act, 2018 (No. 5 of 2018), as operationalised by the Critical Information Infrastructure and Cybercrime Management Regulations, 2024 (LN 44/2024) and the Computer Misuse and Cybercrimes (Amendment) Act, 2024 (assented Oct 2025); institutionally anchored by the National Cybersecurity Agency (NCSA), established by Legal Notice 89 of 2026, and the National KE-CIRT/CC at the Communications Authority of Kenya.
Key points: cybersecurity in Kenya
Primary statute
The Computer Misuse and Cybercrimes Act, 2018 is the horizontal law covering unauthorised access, interference, cyber-fraud, cyber-terrorism, child sexual abuse material and false publications; it also provides the basis for designating and regulating Critical Information Infrastructure.
CII regulations (2024)
The Computer Misuse and Cybercrime (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice 44 of 16 Feb 2024) set out CII designation criteria and binding obligations for operators in sectors such as banking, energy, telecoms and transport, including appointment of a CISO, annual risk assessment, data-localisation of CII and establishment of Cybersecurity Operations Centres.
Breach / incident reporting
Under the 2024 CII Regulations, designated CII owners must report cybersecurity incidents to the National KE-CIRT/CC within 24 hours of detection, in addition to notification duties to the Office of the Data Protection Commissioner for personal-data breaches under the Data Protection Act, 2019.
2024 Amendment Act
The Computer Misuse and Cybercrimes (Amendment) Act, 2024 was assented by President Ruto on 15 October 2025. It refines definitions (computer misuse, cybercrime, CII), expands offences such as SIM-swap fraud, identity theft and online harassment, and tightens CII protections; a coalition of civil-society and opposition petitioners is currently challenging parts of it in court on free-expression grounds.
National Cybersecurity Agency (2026)
The State Corporations (National Cybersecurity Agency) Order, 2026 (Legal Notice 89, gazetted 15 May 2026) established the NCSA as an autonomous state corporation under the Cabinet Secretary for Internal Security, mandated to implement national cybersecurity strategy, audit and certify CII, run the National Cybersecurity Operations Centre and coordinate sectoral SOCs.
KE-CIRT/CC and Communications Authority
The National Kenya Computer Incident Response Team / Coordination Centre (KE-CIRT/CC) remains the operational national point of contact for cyber incidents and is domiciled at the Communications Authority of Kenya, which has a statutory cybersecurity mandate under the Kenya Information and Communications Act, 1998; the Second National Cybersecurity Strategy (2022) sets the policy direction and is being succeeded operationally by the NCSA.
Timeline of decisions
- DecisionODPP appeals cybercrime ruling to the Supreme Court
The Office of the Director of Public Prosecutions filed a Supreme Court appeal seeking to reinstate Sections 22 and 23 of the Computer Misuse and Cybercrimes Act, keeping the scope of criminalised online 'false information' legally unsettled.
Capital FM
- DecisionCourt of Appeal strikes down Sections 22 & 23 of the Cybercrimes Act
In BAKE v Attorney General [2026] KECA 430, the Court of Appeal declared the provisions criminalising 'false' and 'misleading' publication unconstitutional for vagueness, narrowing the Act's reach over online speech.
allAfrica
- GuidanceDraft National Cybersecurity Strategy 2025-2029 released for public input
NC4 published Kenya's second national cybersecurity strategy in draft, adding pillars on incident-response management, AI and emerging technologies, and a target to train 10,000 cybersecurity professionals.
NC4 (draft)
- Incident · officialKE-CIRT/CA reports 2.5 billion cyber threat events in Q1 2025
The Communications Authority's quarterly report recorded roughly 2.5 billion threat events (a ~200% jump), with critical information infrastructure and government systems the leading targets, underscoring the scale driving policy responses.
Communications Authority of Kenya
- IncidentAnonymous Sudan DDoS attacks cripple eCitizen and key services
A coordinated DDoS campaign disrupted the eCitizen portal (5,000+ government services), M-Pesa, power and transport systems; the government acknowledged the attack, exposing the fragility of Kenya's digitised public services.
Tech Monitor
- Guidance · officialNational Cybersecurity Strategy 2022-2027 launched
Kenya adopted a five-year strategy through NC4 and the Interior Ministry, setting governance, critical-infrastructure protection and capacity-building priorities and advising on AI, 5G and IoT security.
Ministry of Interior
- DecisionHigh Court upholds the Computer Misuse and Cybercrimes Act
Justice Makau dismissed the Bloggers Association of Kenya's challenge to 26 sections, lifting the suspension on key provisions and bringing the Act's cybercrime offences fully into force.
Techweez
- Law · officialComputer Misuse and Cybercrimes Act, No. 5 of 2018 assented
Kenya's flagship cybercrime statute created offences for unauthorised access, system interference and cyber-enabled crimes and established the National Computer and Cybercrimes Coordination Committee (NC4).
Kenya Law
- Law · officialKenya Information and Communications Act, 1998 (foundational)
KICA created the sector regulator (now the Communications Authority) and underpins the mandate to run the National KE-CIRT/CC, Kenya's 24/7 cyber-incident coordination centre and national point of contact.
Kenya Law
Sources
- new.kenyalaw.org/akn/ke/act/2018/5/eng@2025-11-04
- new.kenyalaw.org/akn/ke/act/ln/2024/44/eng@2024-02-16
- new.kenyalaw.org/akn/ke/act/ln/2026/89/eng@2026-05-15
- ncsa.go.ke/
- ca.go.ke/cyber-security
- itu.int/en/ITU-D/Cybersecurity/Documents/National_Strategies_Repository/Kenya
- nc4.go.ke/kenya-publishes-computer-misuse-and-cybercrimes-regulations-2024/
- capitalfm.co.ke/news/2025/10/ruto-cybercrime-law-court-challenge-2024/
- new.kenyalaw.org/akn/ke/act/ln/2024/44/eng@2024-02-16/source.pdf
- nc4.go.ke/regulations/computer-misuse-cybercrime-cii-cybercrime-management-regu
- cipit.strathmore.edu/examining-the-2024-computer-misuse-and-cybercrimes-amendment-bill-pro
Next for Kenya: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 15 Oct 2026. Methodology & how to cite · State of Technology Regulation 2026