Practice area
Media & Technology
Tech contracts, data privacy, cyber law and content licensing.
Overview
Media and technology law is the practice of navigating the legal issues that arise at the intersection of technology, media, and the law. In Kenya, this area has grown rapidly with the expansion of internet access, the rise of digital platforms, the growth of the fintech and tech startup ecosystem, and the increasing regulation of the digital economy. The legal framework includes the Kenya Information and Communications Act, 1998 (as amended), the Data Protection Act, 2019, the Computer Misuse and Cybercrimes Act, 2018, the Copyright Act, 2001 (for digital content), and the regulations issued by the Communications Authority of Kenya.
This area covers technology contracts, data protection, cyber law, and digital regulation. On the contracts side, they draft and negotiate software development agreements, software-as-a-service (SaaS) agreements, cloud services agreements, technology transfer agreements, and IT outsourcing contracts. Advocates pay particular attention to service-level agreements, data processing terms, intellectual property ownership, liability caps, and exit provisions — the clauses that determine whether a technology relationship succeeds or fails.
Data protection is one of the most active areas of this practice area. Advocates advise on compliance with the Data Protection Act, 2019, including registration with the Office of the Data Protection Commissioner, the conduct of data protection impact assessments, the drafting of privacy policies, data processing agreements, and data sharing agreements. Advocates advise on cross-border data transfers, the lawful basis for processing, data subject rights, and the management of data breaches. Advocates also handle data protection complaints and enforcement actions.
Cyber law and cybercrime response is a specialised area. Advocates advise businesses on the prevention of cybercrime — including phishing, ransomware, business email compromise, and insider threats — and they assist with the response to cyber incidents, including digital forensics, notification obligations, and engagement with the Directorate of Criminal Investigations and the Communications Authority. Advocates also handle cases involving online defamation, online harassment, and the takedown of infringing content under the Computer Misuse and Cybercrimes Act.
For media and content businesses, they advise on broadcasting licensing, content regulation by the Kenya Film Classification Board, advertising standards, and the management of defamation risk. Advocates handle takedown notices and complaints to the Communications Authority and the Media Council of Kenya. Advocates also draft and negotiate content licensing agreements, distribution agreements, and talent agreements for digital content creators.
For the fintech sector, they advise on the regulatory framework for digital lending, mobile money, peer-to-peer lending, crowdfunding, and cryptocurrency. Advocates monitor the Central Bank of Kenya's regulatory sandbox and the evolving framework for digital financial services, and they help fintech innovators structure their products to comply with the applicable regulatory requirements while preserving their commercial viability.
What’s typically covered
- Software licences, SaaS terms and IT services agreements
- Data Protection Act compliance for digital products
- Website and app terms of use and privacy notices
- Advice on the Computer Misuse and Cybercrimes Act
- Content licensing, publishing and broadcasting regulation
- Fintech and digital-lending regulatory advice
Typical scenarios
- A start-up launching a mobile app that collects customers’ location and payment data.
- A media house responding to a complaint about published content.
- A company whose systems were hacked deciding what it must report and to whom.
Legal services
What Media & Technology includes
Each service below has its own page with a detailed explanation of the work, the process and what to expect.
FAQs
Media & Technology: common questions
Yes, if it collects personal data. The Data Protection Act requires you to tell users what you collect, why, who you share it with and their rights, and to have a lawful basis for each use.
Under the Copyright Act, work created by an employee in the course of employment generally belongs to the employer, but work by an independent contractor generally belongs to the contractor unless the contract assigns it. Put ownership in writing.
Where a breach creates a real risk of harm to data subjects, the Data Protection Act requires the data controller to notify the Data Commissioner within 72 hours of becoming aware of it, and to inform affected individuals where required.
Yes. Non-deposit-taking digital credit providers must be licensed by the Central Bank of Kenya under the Central Bank of Kenya Act and its digital credit provider regulations.
Need help with a media & technology matter?
Create a client account and submit an inquiry — we'll match you with a verified advocate who covers this practice area.