Content moderation regulation in Copyright and Related Rights Bill, 2026

On 31 March 2026, the Kenya Copyright Board closes the consultation on the draft Copyright and Related Rights Bill, 2026. The draft bill would require online intermediaries, including internet service providers, social media platforms, online marketplaces, search engines, and video sharing platforms, to remove or disable access to infringing content within 48 hours of receiving a valid takedown notice and to notify the person responsible for the content within 24 hours. A counter-notice proce...

Primary legal sourceContent ModerationOfficial source · copyright.go.ke ↗

31 DEC 2025 · National Strategy

National AI Strategy 2025-2030 Implementation Roadmap

On 31 December 2025, the Central Government announced the Kenya National AI Strategy 2025-2030 Implementation Roadmap to guide the national digital transformation agenda. The strategy outlines 5 strategic priorities aimed at establishing the country as a leading hub for artificial intelligence (AI) development in Africa by 2030. Key actions include building advanced digital infrastructure, such as intelligent data centres and 5G networks, and creating a secure national dataset and Large Langu...

Official materialNational StrategyOfficial source · ict.go.ke ↗

07 NOV 2025 · Policy / Guidance

National Communication Policy 2025

On 11 July 2025, the Ministry of Information, Communications, and the Digital Economy, through the State Department for Broadcasting and Telecommunications, released the Draft of the National Communication Policy, pending Cabinet approval. The draft establishes a national framework to harmonise and standardise public communication, promoting structured engagement between government institutions and private sector entities. It mandates the establishment of a National Communication Centre to ac...

Official materialContent ModerationOfficial source · ict.go.ke ↗

06 NOV 2025 · Policy / Guidance

Guidance on processing of biometric data

On 6 November 2025, the Office of the Data Protection Commissioner (ODPC) adopted a guidance note on the processing of biometric data. The guidance note, issued under the Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021, sets out regulatory requirements and good practices for the lawful processing of biometric personal data across public and private sectors. It details the lawful bases for processing under Section 30 of the Act, including consent, contractual per...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

06 NOV 2025 · Policy / Guidance

Guidance on processing personal data by micro, small, and medium enterprises

On 6 November 2025, the Office of the Data Protection Commissioner (ODPC) adopted a guidance note on processing personal data by micro, small, and medium enterprises (MSMEs). The guidance note, prepared under the Data Protection Act, 2019, and its subsidiary regulations, aimed to simplify compliance obligations for MSMEs that often operate with limited financial and technical resources. It provided practical templates, checklists, and basic security recommendations to guide MSMEs in lawful da...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

07 OCT 2025 · Executive Order

Income Tax (Significant Economic Presence Tax) Regulations, 2025

On 7 October 2025, the Revenue Authority (KRA), on behalf of the Cabinet Secretary for the National Treasury and Economic Planning, closed the consultation on the Draft Income Tax (Significant Economic Presence Tax) Regulations, 2025. Developed under Section 12E(6) of the Income Tax Act (Cap. 470) and the Statutory Instruments Act (Cap. 2A), the draft Regulations outline a taxation regime for non-resident persons deriving income in Kenya through internet-based or digital marketplace services....

Primary legal sourceNational StrategyOfficial source · kra.go.ke ↗

21 AUG 2025 · Other

Office of the Data Protection Commissioner investigation into Carlcare over alleged use of image without consent

On 21 August 2025, the Office of the Data Protection Commissioner (ODPC) issued a determination in a complaint filed against Carlcare Services Limited by Miriam Okwara Mommbo. The complaint, lodged on 23 May 2025 through legal representatives, alleged that Carlcare Services Limited utilised the complainant's image on its social media platforms for commercial purposes without obtaining her knowledge or express consent. The complainant also highlighted that the images remained posted long after...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

04 JUL 2025 · National Strategy

Office of the Data Protection Commissioner's Strategic Plan (2025-2029) focusing on strengthening data protection regulation

On 4 July 2025, the Office of the Data Protection Commissioner (ODPC) adopted the Strategic Plan 2025–2029 to guide institutional priorities and regulatory actions on personal data protection in Kenya. The Plan seeks to strengthen data protection regulation under the Data Protection Act 2019, aligning with national development frameworks, including Vision 2030 and the Bottom-up Economic Transformational Agenda. The Plan applies to all entities processing personal data across Kenya's public an...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

25 JUN 2025 · Executive Order

Insurance Regulatory Authority Guidance Note on Cybersecurity for the Insurance Industry (Circular No. IC & RE 11/2025)

On 25 June 2025, the Insurance Regulatory Authority (IRA) issued Circular No. IC & RE 11/2025 (Ref: CFN/IRA/00/001/03), titled “Guidance Note on Cybersecurity for the Insurance Industry”, pursuant to sections 3A(a), (b), and (g) of the Insurance Act, CAP. 487 Laws of Kenya. The Guidance Note applies to all licensed insurance and reinsurance companies, with the objective of enhancing cyber resilience, information integrity, and data protection across the sector. It sets out minimum standards f...

Primary legal sourceNational StrategyOfficial source · ira.go.ke ↗

10 JUN 2025 · Executive Order

Order on accession to African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention)

On 6 October 2025, the Office of the Data Protection Commissioner (ODPC) of Kenya closes stakeholder consultations on the country’s accession to the African Union Convention on Cyber Security and Personal Data Protection, also referred to as the Malabo Convention. The consultation began on 18 September 2025, following Cabinet approval and involved ministries, departments, and agencies, county governments, the private sector, academia, civil society, professional bodies, the media, and major d...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

05 JUN 2025 · Law / Act

Government access to data regulation in Finance Bill 2025

On 6 May 2025, the Financial Bill 2025 including government access to data regulation was introduced in the National Assembly. The Bill contains a clause which would enable the tax Commissioner of Kenya to require a person to share data relating to trade secrets and/or personal data held on behalf of customers. Clause 52 of the Bill proposes to amend Section 59A by deleting Section 59A(1B) of the Tax Procedures Act. Section 59A(1B) prevents the Commissioner from requiring a person to "integra...

Primary legal sourceNational StrategyOfficial source · parliament.go.ke ↗

06 MAR 2025 · Law / Act

Office of the Data Protection Commissioner investigation into sectoral compliance with the Data Protection Act, 2019

On 3 June 2025, the Office of the Data Protection Commissioner (ODPC) opened an investigation into sectoral compliance with the Data Protection Act, 2019, focusing on the education, hospitality, and property management sectors. The ODPC initiated nationwide inspections to determine whether organisations have implemented appropriate technical and organisational measures to protect personal data and uphold data subjects’ rights. The investigation aims to assess compliance with statutory obligat...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

15 JAN 2025 · Other

Data Protection Commissioner investigation into Ceres Tech Limited over alleged violation of data protection rights

On 15 January 2025, the Office of the Data Protection Commissioner (ODPC) issued a ruling against Ceres Tech Limited (RocketPesa) with a fine of KES 700,000 following a complaint from a data subject. The ruling found that the company unlawfully processed the complainant’s personal data by associating them with a loan they had not taken, violating their rights under the Data Protection Act, 2019. Despite being notified, RocketPesa failed to respond to ODPC’s inquiries. The determination concl...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

14 JAN 2025 · International Agreement

Kenya-United Arab Emirates Comprehensive Economic Partnership Agreement

On 14 January 2025, the Governments of the Republic of Kenya and the United Arab Emirates signed the Comprehensive Economic Partnership Agreement (CEPA) in Abu Dhabi. The CEPA includes provisions on trade in goods, rules of origin, customs procedures and trade facilitation, sanitary and phytosanitary measures, technical barriers to trade, trade remedies, investment, digital trade, government procurement, intellectual property rights, small and medium-sized enterprises, economic cooperation, d...

Primary legal sourceNational StrategyOfficial source · libraryir.parliament.go.ke ↗

06 JAN 2025 · Executive Order

ODPC Data Protection (Conduct of Compliance Audit) Regulations, 2024

On 6 January 2025, the Office of the Data Protection Commissioner (ODPC) closes its public consultation on the draft Data Protection (Conduct of Compliance Audit) Regulations. The draft regulations provide a framework for conducting data protection audits to assess compliance with the Data Protection Act, 2019. The draft regulations establish procedures for initiating audits, accreditation of data protection auditors, and the responsibilities of data controllers, data processors, and auditors...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

06 JAN 2025 · Executive Order

ODPC Data Sharing Code

On 6 January 2025, the Office of the Data Protection Commissioner (ODPC) closes its public consultation on the draft Data Sharing Code. The draft code provides a framework for responsible and ethical data-sharing practices within both the private and public sectors. It addresses principles such as lawfulness, fairness, transparency, and data minimisation while outlining the legal basis and scope for data sharing. The draft code details the responsibilities of entities involved in data transfe...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

11 DEC 2024 · Policy / Guidance

Ministry of Information, Communications and Digital Economy's Cloud Policy

On 11 December 2024, the Ministry of Information, Communications and the Digital Economy (MICDE) issued the Kenya Cloud Policy (2024). The policy emphasises transitioning from traditional on-premises data centres to cloud infrastructure, aiming to achieve cost savings, improved cybersecurity, scalability, and global reach. It addresses limited resources, security risks, and compliance issues while promoting data residency, sovereignty, and localisation. The policy provides guidelines for new ...

Official materialNational StrategyOfficial source · ict.go.ke ↗

22 OCT 2024 · Law / Act

Critical Infrastructure Protection Bill

On 22 October 2024, the Ministry of Interior and National Administration closed the public consultation period for the Draft Critical Infrastructure Protection Bill, 2024, which commenced on 27 September 2024. During the consultation, stakeholders and the public were invited to provide feedback on the Bill, which focuses on establishing the National Critical Infrastructure Protection Committee, creating a national database for critical infrastructure assets, and enhancing coordination among s...

Primary legal sourceNational StrategyOfficial source · interior.go.ke ↗

24 APR 2024 · International Agreement

US-Kenya Joint Statement on Cross-Border Data Flows

On 24 April 2024, the United States Department of Commerce and the Kenyan Ministry of Information, Communication and the Digital Economy announced the Joint Statement on Cross-Border Data Flows. According to the Joint Statement, the parties announce their intention to cooperate in relation to cross-border data flows.

Primary legal sourceNational StrategyOfficial source · commerce.gov ↗

24 APR 2024 · International Agreement

US-Kenya cooperation agreement on Artificial Intelligence and Digital Upskilling

On 24 April 2024, the US Department of Commerce and Kenya's Ministry for Information, Communications, and the Digital Economy announced a declaration on AI and Digital Up-skilling. The parties agreed to cooperate in areas such as AI safety, knowledge exchange, and best practices. They aim to engage in AI research and standards development, with support from initiatives such as the US AI Safety Institute, and support the use of AI in key sectors, including agriculture, manufacturing, and heal...

Primary legal sourceNational StrategyOfficial source · commerce.gov ↗

22 DEC 2023 · Law / Act

Office of the Data Protection Commissioner guidance on Data Protection Act for digital credit providers

On 22 December 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Note for Digital Credit Providers" to provide clarity on data protection obligations for digital lenders under the Data Protection Act, 2019. The guidance highlights the need for digital credit providers (DCPs) to comply with data protection principles, including transparency, fairness, and lawfulness in processing personal data. It emphasises that DCPs must obtain valid consent, ensure data minim...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

30 NOV 2023 · Law / Act

Office of the Data Protection Commissioner guidance on consent under Data Protection Act

On 30 November 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Notes on Consent" to clarify the requirements for obtaining consent under the Data Protection Act, 2019. The guidance outlines the conditions for valid consent, which must be freely given, informed, specific, and given through an unequivocal action by the data subject. It establishes that consent must be sought before processing personal data, and data controllers and processors are required to pr...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

28 NOV 2023 · Working Paper

Office of the Data Protection Commissioner guidance on data protection impact assessment

On 28 November 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Note on Data Protection Impact Assessment (DPIAs)." The guidance provides a framework for data controllers and data processors to conduct DPIAs in compliance with the Data Protection Act, 2019. DPIAs are required when processing activities may result in high risks to the rights and freedoms of data subjects. The guidance outlines the steps for carrying out DPIAs, including identifying and assessin...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

23 APR 2023 · Other

Office of the Data Protection Commissioner Personal Data Protection Handbook

On 23 April 2023, the Office of the Data Protection Commissioner (ODPC) adopted the Personal Data Protection Handbook. The handbook serves as a guide for data controllers, data processors, and data subjects in Kenya to understand and comply with the Data Protection Act, of 2019. It outlines principles of personal data protection, including lawfulness, fairness, transparency, and data minimisation. The handbook defines personal and sensitive data, elaborates on the roles of data controllers an...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

11 APR 2023 · Other

Office of the Data Protection Commissioner investigation into Whitepath Company Limited for alleged breaches of data protection regulations

On 11 April 2023, the Office of the Data Protection Commissioner (ODPC) issued a penalty notice imposing a penalty of KES 5 million against Whitepath Company Limited for non-compliance with an enforcement notice served on 10 January 2023. With nearly 150 complaints received, Whitepath was found to have accessed users' mobile phone contacts and sent unsolicited text messages, as well as harassed complainants and their contacts. Whitepath is required to pay the penalty, as per Section 63 of the...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

21 JAN 2023 · Standard / Framework

Office of the Data Protection Commissioner alternative dispute resolution framework and guidelines

On 21 January 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Alternative Dispute Resolution (ADR) Framework and Guidelines." The guidelines aim to provide a structured approach for resolving data protection disputes through conciliation, mediation, and negotiation. The ADR process is voluntary, with disputes being referred to the ODPC at any stage before the issuance of an enforcement notice. The guidelines establish the roles of various stakeholders, including the c...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

22 DEC 2022 · Policy / Guidance

Office of the Data Protection Commissioner guidance note on the processing of health data

On 22 December 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Note on the Processing of Health Data" clarifying obligations under the Data Protection Act, 2019. The guidance outlines the principles for lawful processing, including the necessity for consent or legal obligations, and ensures that personal health data is processed transparently and for specified legitimate purposes. The guidance specifies the rights of data subjects, including the right to acc...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

14 JUL 2022 · Executive Order

Data Protection (Registration of Data Controllers and Data Processors) Regulations

On 14 July 2022, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 entered into force. The regulations establish the procedure for registering data controllers and data processors in accordance with the Data Protection Act (No. 24 of 2019). The regulations detail the requirements for registration, the application submission process, and the issuance of registration certificates. The regulations classify data controllers and processors into categories...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

14 JUL 2022 · Policy / Guidance

Office of the Data Protection Commissioner notice on registration commencement for data controllers and data processors

On 14 July 2022, the Office of the Data Protection Commissioner (ODPC) issued a Statement on Registration Commencement for Data Controllers and Data Processors. The Data Protection (Registration of Data Controllers and Data Processor) Regulations, 2021 were published in the Kenya Gazette on 14 January 2022 and are set to come into effect today 14 July 2022. The ODPC noted that following this date, there will be a statutory requirement for any data controller and data processor processing (inc...

Official materialNational StrategyOfficial source · odpc.go.ke ↗

14 FEB 2022 · Executive Order

Data protection regulation in Data Protection (General) Regulations

On 14 February 2022, the Data Protection (General) Regulations, 2021 entered into force. Provisions include data subjects' rights to access, rectify, erase, and port their personal information, as well as the obligation of data controllers and processors to ensure the security and confidentiality of the data. Specific measures include data minimisation, accuracy checks, and storage limitations. Organisations are required to notify authorities and affected individuals of personal data breaches...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

14 FEB 2022 · Executive Order

Data localisation requirement in Data Protection (General) Regulations

On 14 February 2022, the Data Protection (General) Regulations, 2021 entered into force. According to the regulations, data controllers or processors handling personal data for strategic state interests must process the data through a server and data centre in Kenya or store a copy locally. These strategic interests include civil registration, elections, public finance administration, protected computer systems, education services, and primary or secondary healthcare. The Cabinet Secretary ma...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

14 FEB 2022 · Executive Order

Data Protection (Complaints Handling and Enforcement Procedures) Regulations

On 14 February 2022, the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 entered into force. The regulations establish the procedure for lodging, admission, and response to complaints filed under the Data Protection Act (No. 24 of 2019). They outline the process for the Data Commissioner to handle complaints, including registration, investigation, and resolution through alternative dispute resolution mechanisms such as negotiation and mediation. Additionally...

Primary legal sourceNational StrategyOfficial source · odpc.go.ke ↗

22 SEP 2020 · Policy / Guidance

KRA Policy Brief on Taxing the Digital Economy in Kenya

On 22 September 2020, the Kenya Revenue Authority (KRA) issued the Policy Brief on Taxing the Digital Economy in Kenya. It clarifies that the Digital Service Tax (DST) is set at 1.5% of the gross transaction value, and applies income from digital services derived from or accrued in Kenya through digital marketplaces. This tax applies to both resident and non-resident entities, with non-residents required to register if their services are consumed in Kenya. The DST is part of Kenya's efforts t...

Official materialNational StrategyOfficial source · kra.go.ke ↗

Report

Kenya: artificial intelligence readiness assessment report

Examines Kenya's institutions, laws, social conditions and technical capacity for implementing ethical AI. Drawing on research and stakeholder consultation, it identifies gaps in oversight, protection from AI harms and equitable participation, then develops policy recommendations for national governance and institutional capacity.

Official materialNational Strategy ·Research & DevelopmentOfficial source · unesdoc.unesco.org ↗

Policy / Guidance

STATE DEPARTMENT FOR ICT AND THE DIGITAL ECONOMY KENYA ARTIFICIAL INTELLIGENCE AND OTHER EMERGING TECHNOLOGIES POLICY JULY 2026

essential services (Articles 10, 27, 31, 42, and 43) establish the standards that must guide the · development and use of AI and other Emerging Technologies. Without appropriate governance, these technologies may contribute to discrimination,

Official materialNational StrategyOfficial source · ict.go.ke ↗

Other

Building Regulatory Excellence through Global Learning

In July 2026, officers from the Authority joined regulators, policymakers, academics and industry leaders from around the world at the University of Oxford AI and Media Policy Summer Institute , which is an executive programme that explores the evolving policy, governance and regulatory implications ...

Official materialNational StrategyOfficial source · ca.go.ke ↗

Standard / Framework

Artificial Intelligence and Media and Information Literacy in Africa: A Framework for Trust, Critical Evaluation, and Ethical Engagement, Kenya

The rapid integration of artificial intelligence (AI) into media ecosystems is reshaping how information is produced, distributed, and consumed, raising urgent concerns about trust, misinformation, and public understanding . Traditional Media and Information Literacy (MIL) frameworks, designed ...

Official materialNational StrategyOfficial source · journals.unesco.go.ke ↗

Other

Government steps up AI regulation ahead of 2027 polls

Information For Development · FAQ Management Staff Contact Us National Values and Principles

Official materialNational StrategyOfficial source · kenyanews.go.ke ↗

National Strategy

Kenya, COMESA champion inclusive digital transformation through AI – Kenya News Agency

Information For Development · Kenya and the Common Market for Eastern and Southern Africa (COMESA) have committed to working together in developing a harmonised regional framework for artificial intelligence (AI) and digital inclusion to drive economic growth, enhance digital transformation, ...

Official materialNational StrategyOfficial source · kenyanews.go.ke ↗

National Strategy

Kenya charts path for global technology conference – Kenya News Agency

Information For Development · Kenya has committed to strengthening policy frameworks for ethical artificial intelligence (AI), expanding digital infrastructure, and investing in digital skills

Official materialNational StrategyOfficial source · kenyanews.go.ke ↗