Cybersecurity · Kenya
Cybersecurity law & regulation in Kenya (2026)
Kenya shaded by its cybersecurity status
Cybersecurity in Kenya: comprehensive law.
FrameworkComputer Misuse and Cybercrimes Act, 2018 (No. 5 of 2018), as operationalised by the Critical Information Infrastructure and Cybercrime Management Regulations, 2024 (LN 44/2024) and the Computer Misuse and Cybercrimes (Amendment) Act, 2024 (assented Oct 2025); institutionally anchored by the National Cybersecurity Agency (NCSA), established by Legal Notice 89 of 2026, and the National KE-CIRT/CC at the Communications Authority of Kenya.
Kenya has a comprehensive, horizontally-applicable cybersecurity regime built around the Computer Misuse and Cybercrimes Act, 2018, which criminalises a wide range of cyber-offences and empowers the government to designate and regulate Critical Information Infrastructure (CII). Detailed implementing rules came into force in February 2024 (LN 44/2024) and introduced mandatory CII designation, a Chief Information Security Officer requirement, annual risk assessments and a 24-hour incident-reporting duty to the National KE-CIRT/CC. The framework was further strengthened by the 2024 Amendment Act (assented October 2025, now under constitutional challenge) and by the establishment of the National Cybersecurity Agency (NCSA) via Legal Notice 89 of 2026.
Key points
The Computer Misuse and Cybercrimes Act, 2018 is the horizontal law covering unauthorised access, interference, cyber-fraud, cyber-terrorism, child sexual abuse material and false publications; it also provides the basis for designating and regulating Critical Information Infrastructure.
The Computer Misuse and Cybercrime (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice 44 of 16 Feb 2024) set out CII designation criteria and binding obligations for operators in sectors such as banking, energy, telecoms and transport, including appointment of a CISO, annual risk assessment, data-localisation of CII and establishment of Cybersecurity Operations Centres.
Under the 2024 CII Regulations, designated CII owners must report cybersecurity incidents to the National KE-CIRT/CC within 24 hours of detection, in addition to notification duties to the Office of the Data Protection Commissioner for personal-data breaches under the Data Protection Act, 2019.
The Computer Misuse and Cybercrimes (Amendment) Act, 2024 was assented by President Ruto on 15 October 2025. It refines definitions (computer misuse, cybercrime, CII), expands offences such as SIM-swap fraud, identity theft and online harassment, and tightens CII protections; a coalition of civil-society and opposition petitioners is currently challenging parts of it in court on free-expression grounds.
The State Corporations (National Cybersecurity Agency) Order, 2026 (Legal Notice 89, gazetted 15 May 2026) established the NCSA as an autonomous state corporation under the Cabinet Secretary for Internal Security, mandated to implement national cybersecurity strategy, audit and certify CII, run the National Cybersecurity Operations Centre and coordinate sectoral SOCs.
The National Kenya Computer Incident Response Team / Coordination Centre (KE-CIRT/CC) remains the operational national point of contact for cyber incidents and is domiciled at the Communications Authority of Kenya, which has a statutory cybersecurity mandate under the Kenya Information and Communications Act, 1998; the Second National Cybersecurity Strategy (2022) sets the policy direction and is being succeeded operationally by the NCSA.
Timeline - major decisions & events
The Office of the Director of Public Prosecutions filed a Supreme Court appeal seeking to reinstate Sections 22 and 23 of the Computer Misuse and Cybercrimes Act, keeping the scope of criminalised online 'false information' legally unsettled.
Capital FM ↗In BAKE v Attorney General [2026] KECA 430, the Court of Appeal declared the provisions criminalising 'false' and 'misleading' publication unconstitutional for vagueness, narrowing the Act's reach over online speech.
allAfrica ↗NC4 published Kenya's second national cybersecurity strategy in draft, adding pillars on incident-response management, AI and emerging technologies, and a target to train 10,000 cybersecurity professionals.
NC4 (draft) ↗The Communications Authority's quarterly report recorded roughly 2.5 billion threat events (a ~200% jump), with critical information infrastructure and government systems the leading targets, underscoring the scale driving policy responses.
Communications Authority of Kenya ↗The Office of the Data Protection Commissioner imposed precedent-setting fines (including against Whitepath, Regus and Mulla Pride) for unlawful processing and unsolicited messaging, signalling active enforcement of the 2019 Act.
ODPC ↗A coordinated DDoS campaign disrupted the eCitizen portal (5,000+ government services), M-Pesa, power and transport systems; the government acknowledged the attack, exposing the fragility of Kenya's digitised public services.
Tech Monitor ↗Kenya adopted a five-year strategy through NC4 and the Interior Ministry, setting governance, critical-infrastructure protection and capacity-building priorities and advising on AI, 5G and IoT security.
Ministry of Interior ↗The appointment of the inaugural Data Commissioner stood up the Office of the Data Protection Commissioner, giving Kenya a functioning independent authority to register controllers/processors and enforce data-protection (and breach-notification) duties.
ODPC ↗Justice Makau dismissed the Bloggers Association of Kenya's challenge to 26 sections, lifting the suspension on key provisions and bringing the Act's cybercrime offences fully into force.
Techweez ↗Giving effect to the constitutional right to privacy, the Act (commenced 25 Nov 2019) introduced data-controller/processor obligations, breach notification and security safeguards central to Kenya's cybersecurity compliance regime.
Kenya Law ↗Kenya's flagship cybercrime statute created offences for unauthorised access, system interference and cyber-enabled crimes and established the National Computer and Cybercrimes Coordination Committee (NC4).
Kenya Law ↗KICA created the sector regulator (now the Communications Authority) and underpins the mandate to run the National KE-CIRT/CC, Kenya's 24/7 cyber-incident coordination centre and national point of contact.
Kenya Law ↗Kenya - other topics
Cybersecurity in other countries
Last verified 10/15/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →