President William Ruto signed the Computer Misuse and Cybercrimes (Amendment) Act, 2024 into law in October 2025. The law updates Kenya’s existing cybercrime legislation to address new digital threats, protect critical systems, and promote safer online spaces.
While the law aims to strengthen cybersecurity, it has also sparked debate about privacy, freedom of expression, and potential misuse by authorities.
Key Changes Introduced by the Amendment
1. Expanded Definitions and Harsher Penalties
The amendment broadens the definition of cyber offences to include a wider range of online activities.
- Unauthorised access or alteration of data and computer systems is now clearly defined as a crime.
- Cyber harassment now includes conduct that could cause a person to commit self-harm or suicide.
- Penalties for cyber harassment and serious digital offences have been increased to fines of up to KSh 20 million or up to 10 years in prison, or both.
- A new offence of unauthorised SIM swapping has been introduced, punishable by up to two years in prison or a KSh 200,000 fine.
2. Protection of Critical Information Infrastructure
- Operators in these sectors must implement strict cybersecurity measures.
- Companies are required to preserve, secure, and share data relevant to investigations.
- Annual risk assessments and cybersecurity audits will now be mandatory for organisations managing sensitive data.
3. Power to Block Websites and Apps
The National Computer and Cybercrimes Coordination Committee (NCCCC) has been granted authority to order the blocking or removal of websites and applications that promote unlawful activities.
This includes content linked to child exploitation, terrorism, hate speech, and extremist practices.
Courts may also order the removal of digital content found to be unlawful or harmful to public safety.
4. Liability for Aiding and Abetting
Individuals who knowingly assist or abet cyber offences can now face fines of up to KSh 7 million, imprisonment for up to four years, or both.
This provision targets people who help spread illegal content, commit fraud, or support digital crimes indirectly.
How the Law Affects Kenyans
For Ordinary Internet Users
- Posting or sharing false, harmful, or harassing content can attract severe penalties.
- Online behavior that invades privacy, promotes hate, or causes psychological harm is now punishable.
- Users should exercise caution when forwarding unverified information or engaging in online arguments.
- Service providers can be compelled to share user data during investigations, raising new privacy concerns.
For Businesses and Service Providers
- Telecommunication companies, banks, and other critical institutions must adopt stronger data protection and cybersecurity measures.
- Businesses handling personal or financial data face higher compliance obligations and potential penalties for negligence.
- Digital platforms and app developers may be required to act quickly on government takedown directives.
For Civil Society and Media
- Activists and journalists have expressed concern that vague definitions in the law such as “grossly offensive” or “detrimental” content could be used to silence criticism or limit free expression.
- Some sections of the law have already been challenged in court for allegedly infringing on constitutional rights.
- Until judicial review is complete, parts of the Act remain under temporary suspension.
Government’s Position
The government argues that the amended law is crucial to protect citizens from modern digital crimes such as fraud, identity theft, online harassment, and misinformation.
Officials maintain that the law will promote accountability in the digital space and safeguard Kenya’s fast-growing online economy. They also insist that enforcement will respect citizens’ rights and due process.
Concerns Raised
- Vague Wording: Terms like “offensive” or “extremist practices” could be misinterpreted, leading to misuse.
- Freedom of Expression: Critics fear it could suppress online dissent and restrict free speech.
- Privacy Risks: Expanded government access to digital data may weaken data protection rights.
- Impact on Innovation: Startups and small tech firms may face new compliance costs and operational burdens.
- Judicial Oversight: Questions remain about how oversight will be exercised when websites or accounts are blocked.
What Kenyans Should Expect
As the law begins to take effect:
- Online spaces will be more regulated.
- Users must be more cautious about the content they post or share.
- Businesses will have to enhance their cybersecurity and data protection systems.
- Court rulings will continue shaping how the law is enforced and interpreted.
Conclusion
The Computer Misuse and Cybercrimes (Amendment) Act, 2024 marks a significant shift in Kenya’s digital landscape. It aims to protect citizens from the growing dangers of cybercrime while modernizing the country’s digital laws.
However, balancing cybersecurity with freedom of expression and privacy will be crucial. The true impact of the law will depend on how fairly and transparently it is implemented in the years ahead.
