Kenya's Computer Misuse and Cybercrimes Act is usually read as a criminal statute for prosecutors, but it also places duties on organisations that run computer systems: reporting attacks within 24 hours, getting access codes back from departing staff, and responding to preservation and production orders. This guide summarises the offences that matter to security teams, the reporting and cooperation duties, the 2025 amendments and the court rulings on them, and what the Act means for service accounts, API credentials and AI agents. It is for security, legal and compliance leads at organisations operating in Kenya, and complements the Kenya Data Protection Act Guide, which covers personal data duties.
Source note: the official text on Kenya Law could not be accessed when this guide was written (8 November 2026). It is based on secondary sources: copies of the 2018 Act published by the International Center for Not-for-Profit Law (ICNL) and Policy Vault Africa, the Sheriaplex statute reproduction, a CM Advocates analysis of the amendment, and Kenyan news reports and the Bloggers Association of Kenya (BAKE) on the court rulings. Each obligation below names its source. Penalty figures are included only where two independent sources agree. Confirm against the official text before relying on it.
Key takeaways
- Report attacks within 24 hours. Section 40, as reproduced by ICNL and Sheriaplex, requires any person operating a computer system or network, public or private, to inform the National Computer and Cybercrimes Co-ordination Committee (NC4) immediately, within 24 hours, of attacks, intrusions and other disruptions; failure is an offence.
- Get access codes back at exit. Section 41 requires employees to relinquish all codes and access rights to the employer's network or system immediately upon termination, subject to their contract. In practice this is a joiner-mover-leaver control the employer has to run.
- Credential misuse is criminal. Sections 14 (unauthorised access), 19 (unauthorised disclosure of a password or access code) and 29 (identity theft, including use of another person's password or unique identification feature) cover the conduct behind most credential incidents.
- Companies face fines up to KSh 50 million. Section 43 sets that maximum for a body corporate, and principal officers can be personally liable unless they show lack of knowledge and due diligence (ICNL and Policy Vault copies agree).
- The 2025 amendment is partly struck down and under appeal. President Ruto assented to the amendment on 15 October 2025; on 2 July 2026 the High Court declared section 6(1)(ja) (website blocking by NC4 without a court order) and section 27(1)(b) unconstitutional, and Parliament has filed a notice of appeal.
Scope: who and what is covered
The Computer Misuse and Cybercrimes Act, No. 5 of 2018, received assent on 16 May 2018 and commenced on 30 May 2018 (ICNL; Policy Vault Africa copy). Its objects, per section 3 of the copies reviewed, include protecting the confidentiality, integrity and availability of computer systems, programs and data, facilitating the investigation and prosecution of cybercrime, and international cooperation.
| Who | How the Act reaches them | Source |
|---|---|---|
| Any person operating a computer system or network | Duty to report attacks, intrusions and disruptions to NC4 (s.40) | ICNL; Sheriaplex |
| Owners and operators of designated critical information infrastructure | Designation by Gazette notice (s.9); duty to report incidents likely to be an attack and the action planned (s.11) | Policy Vault Africa; ICNL |
| Employers and employees | Employee duty to relinquish codes and access rights on termination (s.41) | ICNL; Sheriaplex |
| Service providers | Preservation, production, real-time collection and interception orders (ss.50 to 53); limitation of liability (s.56) | Policy Vault Africa; ICNL (s.51) |
| Bodies corporate and their principal officers | Corporate offence liability (s.43) | ICNL; Policy Vault Africa |
| Individuals | Offences in Part III (ss.14 to 41) | ICNL; Policy Vault Africa |
NC4 is established by section 4. Per section 6(1) of the Policy Vault copy, its functions include advising the government on security aspects of critical infrastructure and mobile money, receiving and acting on reports, coordinating threat analysis and incident response, cooperating with computer incident response teams, setting cyber security codes and standards, and managing a national public key infrastructure framework.
Key obligations
Reporting duties
- Section 40, reporting of cyber threat: operators of computer systems or networks must immediately inform NC4 of attacks, intrusions and other disruptions, within 24 hours (ICNL; Sheriaplex). Sheriaplex reproduces the required content as information about the breach and how it occurred, an estimate of the number of people affected, an assessment of the risk of harm, and any circumstances that would delay informing affected persons. NC4 may propose isolating an affected system pending resolution (Sheriaplex).
- Section 11, critical information infrastructure: owners or operators of designated systems must report incidents likely to constitute an attack, and state what they plan to do (ICNL; Policy Vault Africa). ICNL's copy shows no specific penalty in section 11.
- Personal data breaches: these also trigger duties under the Data Protection Act 2019. Plan one incident process that produces both reports. See the Kenya Data Protection Act Guide.
Access and credential duties
- Section 41: employees must relinquish all codes and access rights to the employer's computer network or system immediately upon termination, subject to any contract (ICNL; Sheriaplex). Employers should make the hand-back verifiable: an offboarding checklist, credential rotation and evidence that access was removed.
- Section 19: disclosing a password or access code without authority is an offence, with a higher penalty where done for wrongful gain, an unlawful purpose or to cause loss (ICNL; Policy Vault Africa).
Cooperation with investigations
- Search and seizure (s.48) and production orders (s.50): by court warrant or order (Policy Vault Africa).
- Expedited preservation (s.51): traffic data must be preserved for up to 30 days, extendable by a court (ICNL; Policy Vault Africa). Per the Policy Vault copy, service providers must respond expeditiously and disclose enough traffic data to identify other providers involved.
- Real-time collection (s.52) and interception (s.53): by court order; non-compliance by a service provider is an offence (Policy Vault Africa).
- Service provider liability (s.56): per the Policy Vault copy, a provider is not liable without actual notice, actual knowledge or wilful and malicious intent, and is not liable for disclosures the Act requires.
Offences most relevant to security teams
Maximum penalties below are as enacted in 2018 and appear identically in the ICNL and Policy Vault Africa copies. Each is a fine, imprisonment, or both. Some sections were amended in 2025 (see the next section), so confirm current figures in the official text.
| Section | Offence | Maximum fine | Maximum imprisonment |
|---|---|---|---|
| 14 | Unauthorised access | KSh 5 million | 3 years |
| 16 | Unauthorised interference (basic) | KSh 10 million | 5 years |
| 18(1) | Making or distributing illegal devices and access codes | KSh 20 million | 10 years |
| 19 | Unauthorised disclosure of password or access code (basic) | KSh 5 million | 3 years |
| 20 | Offences involving a protected computer system | KSh 25 million | 20 years |
| 26 | Computer fraud | KSh 20 million | 10 years |
| 29 | Identity theft and impersonation | KSh 200,000 | 3 years |
| 30 | Phishing | KSh 300,000 | 3 years |
| 40 | Failure to report a cyber threat | KSh 200,000 | 2 years |
| 41 | Employee failure to relinquish access codes | KSh 200,000 | 2 years |
| 43 | Body corporate | KSh 50 million | Not applicable to the company |
Timeline and current status
| Date | Event | Source |
|---|---|---|
| 16 May 2018 | Act No. 5 of 2018 assented | ICNL; Policy Vault Africa |
| 30 May 2018 | Act commenced | ICNL; Policy Vault Africa |
| 15 October 2025 | Computer Misuse and Cybercrimes (Amendment) Act assented (published as the 2024 Bill; courts refer to it as the 2025 Act) | CM Advocates; The Star |
| 22 October 2025 | High Court conservatory order suspending parts of the amendment pending hearing | BAKE; Digital Policy Alert |
| 2 July 2026 | High Court declares section 6(1)(ja) and section 27(1)(b) of the amendment unconstitutional; other amendments stand | Citizen Digital; Digital Policy Alert |
| July 2026 | National Assembly, its Speaker and Parliament file a notice of appeal to the Court of Appeal | Citizen Digital |
What the 2025 amendment changed, as reported:
- Definitions: CM Advocates reports that "access" now includes access through a program or device, and that "asset" covers virtual property; The Star reports new definitions including identity theft and digital asset.
- Identity theft: The Star reports a specific offence of unauthorised use of another person's identification number, SIM card, bank account details, password or subscriber information. CM Advocates reports a new SIM swap offence.
- Phishing: The Star reports that section 30 was extended to emails and phone calls.
- Content blocking: section 6(1)(ja) allowed NC4 to order websites or applications blocked without a court order; the High Court struck it down on 2 July 2026 (Citizen Digital), and that ruling is under appeal.
- Service providers: CM Advocates reports duties to retain and disclose data relevant to investigations, including virtual asset records.
Status may change with the Court of Appeal. Treat the amendment's offence wording as current except for the two provisions declared unconstitutional, and check for later rulings.
Enforcement and penalties
- Who enforces: NC4 receives reports and coordinates response (s.6, Policy Vault Africa). Prosecution follows normal criminal process.
- Corporate liability: under section 43, a body corporate can be fined up to KSh 50 million, and principal officers are presumed liable unless they prove the offence happened without their consent or knowledge and that they exercised due diligence (ICNL; Policy Vault Africa). Board and executive attention to cyber controls is therefore a personal matter for officers.
- Aiding and abetting: ICNL's copy sets a separate offence in section 42.
- Court orders: under the reported section 46A, courts can order removal of unlawful content or deactivation of systems used for terrorism, child exploitation or extremist propaganda (The Star).
What it means for AI agents and non-human identities
The Act's language is technology-neutral, so it applies to machine credentials and automated actors without naming them.
| Provision | NHI and agent reading | Control to apply |
|---|---|---|
| s.14 unauthorised access; amended definition of access through a program or device | An agent or script that uses credentials beyond its authorisation is conduct the section can reach; the person deploying it carries the risk | Least-privilege scopes for each agent and service account; written authorisation for automation |
| s.19 disclosure of password or access code | Pasting API keys into tickets, chat or public repositories, or sharing a service account password, is a disclosure risk | Secrets manager; secret scanning; no shared passwords |
| s.29 identity theft (password or unique identification feature) | Use of another identity's token or key, including an employee's token reused by a bot | One identity per workload or agent; no token reuse across systems |
| s.41 relinquish access codes on termination | Leavers often know service account passwords, deploy keys and API tokens, not just their own login | Rotate every shared or known secret at exit; owner reassignment for service accounts |
| s.40 reporting within 24 hours | A stolen cloud key or abused OAuth token can be an intrusion to report | Detection on machine identities so the 24-hour clock can be met |
See the Service Account Security Guide, the Leaked Credential Response Playbook and the Agentic AI Identity Guide.
Compliance steps
- Confirm the text. Have Kenyan counsel obtain the official consolidated Act and the 2025 amendment, and track the Court of Appeal.
- Check designation. Find out whether any of your systems are designated critical information infrastructure under section 9, which adds section 11 reporting and directives.
- Build a 24-hour NC4 path. Add NC4 reporting to the incident response plan with a named owner, a contact route confirmed with counsel, and a template covering the section 40 content.
- Join up breach reporting. Run one triage that decides on NC4 reporting and Data Protection Act notification together.
- Harden offboarding. Make section 41 operational: revoke accounts, collect devices and tokens, and rotate any shared secret the leaver knew. Record evidence.
- Govern machine identities. Inventory service accounts, API keys and agents, assign owners, and keep authorisation records that show what each is allowed to do.
- Prepare for orders. Service providers should have a legal intake process for preservation, production and interception orders, with logging that can meet the 30-day preservation window.
- Brief officers. Explain section 43 personal liability and the due diligence defence to directors, and keep board minutes showing cyber oversight.
- Test. Run a tabletop exercise with a credential compromise scenario and time the decision to report.
Rollback is not a concept for a statute, but the plan can be staged: start with reporting and offboarding, the two duties that carry direct offences, then extend to machine identity governance.
Measuring it
- Time from detection to NC4 reporting decision, against the 24-hour limit.
- Share of leavers whose access and known shared secrets were removed on the last working day.
- Share of service accounts and API keys with a named owner.
- Number of exposed secrets found by scanning and median time to rotate.
- Preservation requests answered within the agreed time (service providers).
Practitioner checklist
- Obtain the official consolidated Act and 2025 amendment and monitor the Court of Appeal.
- Confirm whether any system is designated critical information infrastructure.
- Add a 24-hour NC4 reporting step and template to the incident response plan.
- Run NC4 and Data Protection Act reporting decisions from one triage.
- Revoke access and rotate known shared secrets for every leaver, with evidence.
- Inventory service accounts, API keys and AI agents with owners and documented authorisation.
- Store secrets in a secrets manager and scan code and tickets for exposed credentials.
- Set up a legal intake process for preservation and production orders.
- Brief directors on section 43 liability and record cyber oversight.
Standards and references
- ICNL: Kenya Computer Misuse and Cybercrimes Act No. 5 of 2018 (text)
- Policy Vault Africa: Computer Misuse and Cybercrimes Act 2018 (copy)
- Sheriaplex: Section 40, Reporting of cyber threat
- CM Advocates: Computer Misuse and Cybercrimes (Amendment) Act analysis
- The Star: State tightens cyber laws in move against online crime
- Citizen Digital: High Court strikes down website blocking provision
- Citizen Digital: Parliament to appeal High Court ruling
- BAKE: High Court suspends sections of the 2025 Amendment Act
Related NHI Mgmt Group resources: Kenya Data Protection Act Guide · Service Account Security Guide · Leaked Credential Response Playbook · Agentic AI Identity Guide. This guide summarises the Kenya Computer Misuse and Cybercrimes Act and its amendments from secondary sources and is not legal advice.