Legal cybersecurity practices, as well as penalties for unauthorized access to computer systems, are established under the Computer Misuse and Cybercrimes Act.
Additionally, the Act also provides a clear legal framework for activities that might otherwise be classified as hacking.
Kenya enacted the Computer Misuse and Cybercrimes (Amendment) Act 2025, which President William Ruto signed into law on October 15, 2024, to update the 2018 Act.
The law was intended to help tackle emerging cyber threats, strengthen digital safety, and clarify court oversight of cyber offenses.
Tools used for cyberattacks are often the same tools required to defend systems and are recognized under the law.
Under Section 18, the possession or use of programs or access codes designed for hacking is not an offense if the act is intended for authorized training, testing, or the protection of a computer system.
“The activities… do not constitute an offence if any act is intended for the authorized training, testing, or protection of a computer system.” Section 18(3)(a) of the Act states.
This provision allows cybersecurity professionals to conduct white-hat hacking.
Legal Cybersecurity Authorized Persons
An authorized person is a law enforcement officer or a cybersecurity expert designated by the Cabinet Secretary via the Kenya Gazette.
Such individuals are tasked with auditing critical information infrastructure that could threaten national security or essential services.
However, to legally perform such an audit, a person must have a written authorization and a certificate of appointment from the Director of the National Computer and Cybercrimes Co-ordination Committee.
Judicial Oversight on Legal Cybersecurity
Law enforcement agencies can legally access, search, and seize stored computer data only after obtaining a court-issued warrant.
Real -time collection of traffic data and the interception of content data is allowed by the law if a police officer obtains a specific judicial order.
Judicial orders for data interception are granted for a limited duration of six to nine months to assist in criminal investigations.
“Access by a person to a computer system is unauthorized if that person is not entitled to control access… or does not have consent from any person who is entitled to access,” the act states in Section 14(2).
International Cooperation
An authorized person or the police are legally allowed to access under the law located in a foreign territory if they can acquire voluntary consent for the action to be a legal cybersecurity practice.
In addition to the consent being voluntary, it should be obtained lawfully from the person who has the right to disclose the data.
Moreover, the Act facilitates international cooperation, allowing Kenya’s Central Authority to request or provide mutual legal assistance the preserve and disclose electronic evidence.
Also Read: How University Dropout Hacked Bank System and Drained Millions- DCI
Digital Safety Under the Computer Misuse and Cybercrimes Law
To enhance the safety and security of digital users, the law imposes penalties for offences including cyber fraud, hacking, identity theft, cyber harassment, and the exploitation of minors.
Penalties include fines ranging from Ksh 300,000 to Ksh 20 million, imprisonment of 6 months to 10 years, or both, depending on the offense committed.
Individuals who attempt or commit cybercrimes, as well as those who aid them, are liable to fines of up to Ksh 7 million, imprisonment of up to 4 years, or both.
Additionally, creating fake websites or sending deceptive messages to gain unauthorized access is punishable by a fine of up to Ksh 300,000, imprisonment of up to 3 years, or both.
Communicating in a way that causes fear or harm is also punishable by a fine of up to Ksh 20 million, imprisonment of up to 10 years, or both.
Also Read: Govt Issues New Guidelines on Password Storage and Cybersecurity
Offenses Under the Amendment Act 2025
- Cyber harassment
- Communication offenses
- Promotion of unlawful activities
The Computer Misuse and Cybercrimes Act, however, does not limit online expression or personal opinions, nor does it allow the government to spy on or censor content without a court order.
