Content moderation regulation in Copyright and Related Rights Bill, 2026

On 31 March 2026, the Kenya Copyright Board closes the consultation on the draft Copyright and Related Rights Bill, 2026. The draft bill would require online intermediaries, including internet service providers, social media platforms, online marketplaces, search engines, and video sharing platforms, to remove or disable access to infringing content within 48 hours of receiving a valid takedown notice and to notify the person responsible for the content within 24 hours. A counter-notice proce...

Primary legal sourceContent ModerationOfficial source · copyright.go.ke ↗

20 MAR 2026 · Law / Act

Kenya - Proposed AI Law Following EU Risk Framework

Kenya is developing an AI law that aligns with the European Union's risk-based framework, signaling a move toward stricter oversight of AI systems. The proposed Kenyan framework emphasizes high-risk AI classification, transparency, and accountability.

Secondary evidenceNational AI Law ·EU Alignment ·Risk-BasedIssuing institution: Issuing authority not identified

31 DEC 2025 · National Strategy

National AI Strategy 2025-2030 Implementation Roadmap

On 31 December 2025, the Central Government announced the Kenya National AI Strategy 2025-2030 Implementation Roadmap to guide the national digital transformation agenda. The strategy outlines 5 strategic priorities aimed at establishing the country as a leading hub for artificial intelligence (AI) development in Africa by 2030. Key actions include building advanced digital infrastructure, such as intelligent data centres and 5G networks, and creating a secure national dataset and Large Langu...

Official materialNational StrategyOfficial source · ict.go.ke ↗

07 NOV 2025 · Policy / Guidance

National Communication Policy 2025

On 11 July 2025, the Ministry of Information, Communications, and the Digital Economy, through the State Department for Broadcasting and Telecommunications, released the Draft of the National Communication Policy, pending Cabinet approval. The draft establishes a national framework to harmonise and standardise public communication, promoting structured engagement between government institutions and private sector entities. It mandates the establishment of a National Communication Centre to ac...

Official materialContent ModerationOfficial source · ict.go.ke ↗

06 NOV 2025 · Policy / Guidance

Guidance on processing of biometric data

On 6 November 2025, the Office of the Data Protection Commissioner (ODPC) adopted a guidance note on the processing of biometric data. The guidance note, issued under the Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021, sets out regulatory requirements and good practices for the lawful processing of biometric personal data across public and private sectors. It details the lawful bases for processing under Section 30 of the Act, including consent, contractual per...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

06 NOV 2025 · Policy / Guidance

Guidance on processing personal data by micro, small, and medium enterprises

On 6 November 2025, the Office of the Data Protection Commissioner (ODPC) adopted a guidance note on processing personal data by micro, small, and medium enterprises (MSMEs). The guidance note, prepared under the Data Protection Act, 2019, and its subsidiary regulations, aimed to simplify compliance obligations for MSMEs that often operate with limited financial and technical resources. It provided practical templates, checklists, and basic security recommendations to guide MSMEs in lawful da...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

04 NOV 2025 · Law / Act

Content moderation regulation in Computer Misuse and Cybercrimes (Amendment) Act, 2025

On 4 November 2025, the Computer Misuse and Cybercrimes (Amendment) Act, 2025, enters into force. The amendment modifies Section 6 of the principal Computer Misuse and Cybercrimes Act, granting the National Computer and Cybercrimes Coordination Committee (NC4) explicit authority to issue directives requiring the blocking of websites or applications within Kenya. Specifically, the Act gives courts the power to order the removal of digital content and the closing of computer systems in connecti...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

07 OCT 2025 · Executive Order

Income Tax (Significant Economic Presence Tax) Regulations, 2025

On 7 October 2025, the Revenue Authority (KRA), on behalf of the Cabinet Secretary for the National Treasury and Economic Planning, closed the consultation on the Draft Income Tax (Significant Economic Presence Tax) Regulations, 2025. Developed under Section 12E(6) of the Income Tax Act (Cap. 470) and the Statutory Instruments Act (Cap. 2A), the draft Regulations outline a taxation regime for non-resident persons deriving income in Kenya through internet-based or digital marketplace services....

Primary legal sourceNational StrategyOfficial source · kra.go.ke ↗

21 AUG 2025 · Other

Office of the Data Protection Commissioner investigation into Carlcare over alleged use of image without consent

On 21 August 2025, the Office of the Data Protection Commissioner (ODPC) issued a determination in a complaint filed against Carlcare Services Limited by Miriam Okwara Mommbo. The complaint, lodged on 23 May 2025 through legal representatives, alleged that Carlcare Services Limited utilised the complainant's image on its social media platforms for commercial purposes without obtaining her knowledge or express consent. The complainant also highlighted that the images remained posted long after...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

18 JUL 2025 · Court Case

Lawsuit concerning mandatory disclosure of International Mobile Equipment Identity (IMEI) data (Katiba Institute v Communications Authority of Kenya, Kenya Revenue Authority, and others / Petition E647 of 2024)

On 18 July 2025, the High Court of Kenya at Nairobi, Constitutional and Human Rights Division, delivered judgment in Katiba Institute v State Law Office and others (Petition E647 of 2024) concerning the lawfulness of mandatory IMEI registration. The Court held that an IMEI number, when associated with an identifiable subscriber or importer, qualifies as personal data under Section 2 of the Data Protection Act (2019). It found that the Communications Authority of Kenya and the Kenya Revenue Au...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

04 JUL 2025 · National Strategy

Office of the Data Protection Commissioner's Strategic Plan (2025-2029) focusing on strengthening data protection regulation

On 4 July 2025, the Office of the Data Protection Commissioner (ODPC) adopted the Strategic Plan 2025–2029 to guide institutional priorities and regulatory actions on personal data protection in Kenya. The Plan seeks to strengthen data protection regulation under the Data Protection Act 2019, aligning with national development frameworks, including Vision 2030 and the Bottom-up Economic Transformational Agenda. The Plan applies to all entities processing personal data across Kenya's public an...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

25 JUN 2025 · Executive Order

Insurance Regulatory Authority Guidance Note on Cybersecurity for the Insurance Industry (Circular No. IC & RE 11/2025)

On 25 June 2025, the Insurance Regulatory Authority (IRA) issued Circular No. IC & RE 11/2025 (Ref: CFN/IRA/00/001/03), titled “Guidance Note on Cybersecurity for the Insurance Industry”, pursuant to sections 3A(a), (b), and (g) of the Insurance Act, CAP. 487 Laws of Kenya. The Guidance Note applies to all licensed insurance and reinsurance companies, with the objective of enhancing cyber resilience, information integrity, and data protection across the sector. It sets out minimum standards f...

Primary legal sourceNational StrategyOfficial source · ira.go.ke ↗

10 JUN 2025 · Executive Order

Order on accession to African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention)

On 6 October 2025, the Office of the Data Protection Commissioner (ODPC) of Kenya closes stakeholder consultations on the country’s accession to the African Union Convention on Cyber Security and Personal Data Protection, also referred to as the Malabo Convention. The consultation began on 18 September 2025, following Cabinet approval and involved ministries, departments, and agencies, county governments, the private sector, academia, civil society, professional bodies, the media, and major d...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

05 JUN 2025 · Law / Act

Government access to data regulation in Finance Bill 2025

On 6 May 2025, the Financial Bill 2025 including government access to data regulation was introduced in the National Assembly. The Bill contains a clause which would enable the tax Commissioner of Kenya to require a person to share data relating to trade secrets and/or personal data held on behalf of customers. Clause 52 of the Bill proposes to amend Section 59A by deleting Section 59A(1B) of the Tax Procedures Act. Section 59A(1B) prevents the Commissioner from requiring a person to "integra...

Primary legal sourceNational StrategyOfficial source · parliament.go.ke ↗

26 MAY 2025 · Court Case

Lawsuit concerning unauthorised publication of personal data on digital platforms (Ndung'u and another v Wachira and another / Constitutional Petition E047 of 2025)

On 26 May 2025, the High Court of Kenya at Nairobi delivered its ruling in Constitutional Petition E047 of 2025, upholding the Preliminary Objection dated 21 February 2025. The Court found that the petitioners had not exhausted statutory and administrative remedies before the Office of the Data Protection Commissioner or the Media Council of Kenya, and that the dispute was a private civil matter not meeting the constitutional threshold. Applying the doctrines of exhaustion and constitutional ...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

05 MAY 2025 · Other

Office of the Data Protection Commissioner investigation into Worldcoin regarding its operations in Kenya

On 5 May 2025, the High Court in Nairobi ruled on an investigation by the Kenyan Office of the Data Protection Commissioner (ODPC) into alleged data protection violations by Worldcoin. The Court found that Worldcoin had failed to comply with the mandatory legal requirements for processing sensitive personal data under the Data Protection Act, 2019, amounting to a breach of Kenyan citizens’ constitutional right to privacy. It further held that Worldcoin had collected personal data without obta...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

02 MAY 2025 · Executive Order

Data protection regulation in the Kenya Cloud Policy, 2025

On 2 May 2025, the Kenya Cloud Policy, 2025 became effective following its publication in the Kenya Gazette. This policy, in line with the Kenya Information and Communication Act, includes provisions to ensure that all cloud deployments comply with the Data Protection Act (2019), the Children’s Act (2022), and related laws. It mandates the implementation of data security and privacy controls in line with international standards, including ISO 27017 and ISO 27018.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

03 APR 2025 · Court Case

Ethiopian Researchers and Katiba Institute lawsuit against Meta for alleged incitement to violence and hate speech on platform

On 3 April 2025, the High Court of Kenya ruled that a constitutional petition brought against Meta by two Ethiopian nationals and the Katiba Institute could proceed, dismissing Meta’s application to strike out the case on jurisdictional grounds. The petition, originally filed on 14 December 2022, alleges that Meta’s Facebook platform contributed to the dissemination of harmful and inflammatory content during the conflict in Ethiopia, citing the role of the platform’s algorithm and the adequac...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

06 MAR 2025 · Law / Act

Office of the Data Protection Commissioner investigation into sectoral compliance with the Data Protection Act, 2019

On 3 June 2025, the Office of the Data Protection Commissioner (ODPC) opened an investigation into sectoral compliance with the Data Protection Act, 2019, focusing on the education, hospitality, and property management sectors. The ODPC initiated nationwide inspections to determine whether organisations have implemented appropriate technical and organisational measures to protect personal data and uphold data subjects’ rights. The investigation aims to assess compliance with statutory obligat...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

15 JAN 2025 · Other

Data Protection Commissioner investigation into Ceres Tech Limited over alleged violation of data protection rights

On 15 January 2025, the Office of the Data Protection Commissioner (ODPC) issued a ruling against Ceres Tech Limited (RocketPesa) with a fine of KES 700,000 following a complaint from a data subject. The ruling found that the company unlawfully processed the complainant’s personal data by associating them with a loan they had not taken, violating their rights under the Data Protection Act, 2019. Despite being notified, RocketPesa failed to respond to ODPC’s inquiries. The determination concl...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

14 JAN 2025 · International Agreement

Kenya-United Arab Emirates Comprehensive Economic Partnership Agreement

On 14 January 2025, the Governments of the Republic of Kenya and the United Arab Emirates signed the Comprehensive Economic Partnership Agreement (CEPA) in Abu Dhabi. The CEPA includes provisions on trade in goods, rules of origin, customs procedures and trade facilitation, sanitary and phytosanitary measures, technical barriers to trade, trade remedies, investment, digital trade, government procurement, intellectual property rights, small and medium-sized enterprises, economic cooperation, d...

Primary legal sourceNational StrategyOfficial source · libraryir.parliament.go.ke ↗

06 JAN 2025 · Executive Order

ODPC Data Protection (Conduct of Compliance Audit) Regulations, 2024

On 6 January 2025, the Office of the Data Protection Commissioner (ODPC) closes its public consultation on the draft Data Protection (Conduct of Compliance Audit) Regulations. The draft regulations provide a framework for conducting data protection audits to assess compliance with the Data Protection Act, 2019. The draft regulations establish procedures for initiating audits, accreditation of data protection auditors, and the responsibilities of data controllers, data processors, and auditors...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

06 JAN 2025 · Executive Order

ODPC Data Sharing Code

On 6 January 2025, the Office of the Data Protection Commissioner (ODPC) closes its public consultation on the draft Data Sharing Code. The draft code provides a framework for responsible and ethical data-sharing practices within both the private and public sectors. It addresses principles such as lawfulness, fairness, transparency, and data minimisation while outlining the legal basis and scope for data sharing. The draft code details the responsibilities of entities involved in data transfe...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

11 DEC 2024 · Policy / Guidance

Ministry of Information, Communications and Digital Economy's Cloud Policy

On 11 December 2024, the Ministry of Information, Communications and the Digital Economy (MICDE) issued the Kenya Cloud Policy (2024). The policy emphasises transitioning from traditional on-premises data centres to cloud infrastructure, aiming to achieve cost savings, improved cybersecurity, scalability, and global reach. It addresses limited resources, security risks, and compliance issues while promoting data residency, sovereignty, and localisation. The policy provides guidelines for new ...

Official materialNational StrategyOfficial source · ict.go.ke ↗

22 OCT 2024 · Law / Act

Critical Infrastructure Protection Bill

On 22 October 2024, the Ministry of Interior and National Administration closed the public consultation period for the Draft Critical Infrastructure Protection Bill, 2024, which commenced on 27 September 2024. During the consultation, stakeholders and the public were invited to provide feedback on the Bill, which focuses on establishing the National Critical Infrastructure Protection Committee, creating a national database for critical infrastructure assets, and enhancing coordination among s...

Primary legal sourceNational StrategyOfficial source · interior.go.ke ↗

12 JUL 2024 · Law / Act

Protection of Critical Infrastructure Bill (Senate Bill No. 38 of 2024)

On 12 July 2024, the Kenyan Senate introduced the Protection of Critical Infrastructure Bill, 2024 (Senate Bill No. 38 of 2024). The Bill establishes the Critical Infrastructure Protection Committee and the Critical Infrastructure Protection Secretariat to formulate policy guidelines, oversee security measures, and maintain a national database of critical infrastructure. It outlines procedures for designating and revoking critical infrastructure status, mandates service continuity plans, and ...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

13 JUN 2024 · Executive Order

Testing requirement in Bureau of Standards Code of Practice for AI Applications (DKS 3007:2024)

On 13 June 2024, the Kenya Bureau of Standards (KEBS) closes the public consultation period for the Draft Kenya Standard titled “Information Technology — Artificial Intelligence (AI) — Code of Practice for AI Applications” (DKS 3007:2024). The draft, which was open for review from 8 April 2024, outlined a framework for the responsible development and deployment of AI systems. It addresses areas such as trustworthiness, risk management, and ethical considerations, referencing international sta...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

23 MAY 2024 · Other

United States of America-Kenya Joint Leaders' Statement including measures regarding cooperation on digital technologies

On 23 May 2024, the White House issued the United States of America-Kenya Joint Leader's Statement, which includes commitments on cooperation in digital technology. Both nations committed to strengthening cooperation on policies concerning technology sectors to support Kenya's digital economy and promote digital inclusion continent-wide. Additionally, the United States recognises Kenya as a crucial partner in strengthening semiconductor supply chains. In particular, the parties are committed...

Official materialNational StrategyOfficial source · whitehouse.gov ↗

24 APR 2024 · International Agreement

US-Kenya Joint Statement on Cross-Border Data Flows

On 24 April 2024, the United States Department of Commerce and the Kenyan Ministry of Information, Communication and the Digital Economy announced the Joint Statement on Cross-Border Data Flows. According to the Joint Statement, the parties announce their intention to cooperate in relation to cross-border data flows.

Primary legal sourceNational StrategyOfficial source · commerce.gov ↗

24 APR 2024 · International Agreement

US-Kenya cooperation agreement on Artificial Intelligence and Digital Upskilling

On 24 April 2024, the US Department of Commerce and Kenya's Ministry for Information, Communications, and the Digital Economy announced a declaration on AI and Digital Up-skilling. The parties agreed to cooperate in areas such as AI safety, knowledge exchange, and best practices. They aim to engage in AI research and standards development, with support from initiatives such as the US AI Safety Institute, and support the use of AI in key sectors, including agriculture, manufacturing, and heal...

Primary legal sourceNational StrategyOfficial source · commerce.gov ↗

09 FEB 2024 · Executive Order

Measures establishing Cybersecurity Operations Centres in Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024

On 9 February 2024, the Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024, entered into force to provide a framework for monitoring, detecting, and responding to cybersecurity threats in Kenya’s cyberspace. The regulations establish Cybersecurity Operations Centres, including the National Cybersecurity Operations Centre, Sector Cybersecurity Operations Centres, and Critical Information Infrastructure Cybersecurity Operations Cent...

Primary legal sourceNational StrategyOfficial source · nc4.go.ke ↗

22 DEC 2023 · Law / Act

Office of the Data Protection Commissioner guidance on Data Protection Act for digital credit providers

On 22 December 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Note for Digital Credit Providers" to provide clarity on data protection obligations for digital lenders under the Data Protection Act, 2019. The guidance highlights the need for digital credit providers (DCPs) to comply with data protection principles, including transparency, fairness, and lawfulness in processing personal data. It emphasises that DCPs must obtain valid consent, ensure data minim...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

30 NOV 2023 · Law / Act

Office of the Data Protection Commissioner guidance on consent under Data Protection Act

On 30 November 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Notes on Consent" to clarify the requirements for obtaining consent under the Data Protection Act, 2019. The guidance outlines the conditions for valid consent, which must be freely given, informed, specific, and given through an unequivocal action by the data subject. It establishes that consent must be sought before processing personal data, and data controllers and processors are required to pr...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

29 NOV 2023 · Law / Act

Registration and Licensing Requirements in Kenya Robotics and Artificial Intelligence Society Bill

On 29 November 2023, the Kenya Robotics and Artificial Intelligence Society Bill was introduced to the Parliament of Kenya. The Bill establishes the Kenya Robotics and Artificial Intelligence Society (RSK) aiming to regulate and foster the development of the robotics and AI industry. The RSK will formulate and enforce industry standards and codes of practice and will conduct surveillance and inspections to ensure compliance with standards and legislation on robotics and AI. More specifically,...

Primary legal sourceNational StrategyOfficial source · parliament.go.ke ↗

28 NOV 2023 · Working Paper

Office of the Data Protection Commissioner guidance on data protection impact assessment

On 28 November 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Note on Data Protection Impact Assessment (DPIAs)." The guidance provides a framework for data controllers and data processors to conduct DPIAs in compliance with the Data Protection Act, 2019. DPIAs are required when processing activities may result in high risks to the rights and freedoms of data subjects. The guidance outlines the steps for carrying out DPIAs, including identifying and assessin...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

23 APR 2023 · Other

Office of the Data Protection Commissioner Personal Data Protection Handbook

On 23 April 2023, the Office of the Data Protection Commissioner (ODPC) adopted the Personal Data Protection Handbook. The handbook serves as a guide for data controllers, data processors, and data subjects in Kenya to understand and comply with the Data Protection Act, of 2019. It outlines principles of personal data protection, including lawfulness, fairness, transparency, and data minimisation. The handbook defines personal and sensitive data, elaborates on the roles of data controllers an...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

11 APR 2023 · Other

Office of the Data Protection Commissioner investigation into Whitepath Company Limited for alleged breaches of data protection regulations

On 11 April 2023, the Office of the Data Protection Commissioner (ODPC) issued a penalty notice imposing a penalty of KES 5 million against Whitepath Company Limited for non-compliance with an enforcement notice served on 10 January 2023. With nearly 150 complaints received, Whitepath was found to have accessed users' mobile phone contacts and sent unsolicited text messages, as well as harassed complainants and their contacts. Whitepath is required to pay the penalty, as per Section 63 of the...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

21 JAN 2023 · Standard / Framework

Office of the Data Protection Commissioner alternative dispute resolution framework and guidelines

On 21 January 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Alternative Dispute Resolution (ADR) Framework and Guidelines." The guidelines aim to provide a structured approach for resolving data protection disputes through conciliation, mediation, and negotiation. The ADR process is voluntary, with disputes being referred to the ODPC at any stage before the issuance of an enforcement notice. The guidelines establish the roles of various stakeholders, including the c...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

22 DEC 2022 · Policy / Guidance

Office of the Data Protection Commissioner guidance note on the processing of health data

On 22 December 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Note on the Processing of Health Data" clarifying obligations under the Data Protection Act, 2019. The guidance outlines the principles for lawful processing, including the necessity for consent or legal obligations, and ensures that personal health data is processed transparently and for specified legitimate purposes. The guidance specifies the rights of data subjects, including the right to acc...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

14 JUL 2022 · Executive Order

Data Protection (Registration of Data Controllers and Data Processors) Regulations

On 14 July 2022, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 entered into force. The regulations establish the procedure for registering data controllers and data processors in accordance with the Data Protection Act (No. 24 of 2019). The regulations detail the requirements for registration, the application submission process, and the issuance of registration certificates. The regulations classify data controllers and processors into categories...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗