Kenya’s Cybercrimes Act: offences businesses should know

The Computer Misuse and Cybercrimes Act, 2018 criminalises a range of computer-related conduct and gives investigators powers to obtain electronic evidence.

Key offences

• unauthorised access to a computer system,
• access with intent to commit a further offence,
• unauthorised interference with data or systems,
• computer fraud and forgery,
• cyber harassment and cyberstalking,
• identity theft and impersonation, and
• phishing.

Penalties include significant fines and imprisonment.

What businesses should do

1. Restrict access on a need-to-know basis and remove access promptly when staff leave.
2. Log access to critical systems — logs are essential evidence.
3. Train staff on phishing and social engineering.
4. Prepare an incident response plan, including who reports to the police and, where personal data is affected, to the Data Protection Commissioner.
5. Preserve evidence — do not wipe affected systems before forensic imaging.

Reporting

Report cybercrime to the Directorate of Criminal Investigations. Some sectors also have reporting duties to their regulators.

This article is general information, not legal advice on your situation.

Get help from a verified advocate

This article is general information, not legal advice on your situation. If you need advice, describe your matter on Wakili Link and we will match you with a verified advocate who handles it.

• Regulatory & compliance lawyers in Kenya
• Data protection compliance
• How to verify an advocate in Kenya