Kenya's New Cybercrime Laws 2025: What Business Owners Must Know

Kenya's cybercrime laws changed fundamentally when the Computer Misuse and Cybercrimes (Amendment) Act became effective November 4, 2025. If you run a business—or work in one—you need to understand what shifted, because the penalties are steep and the new offences cover ground that didn't exist before.

The problem is real. Mobile banking fraud surged by 344 per cent to KSh 810.68 million in 2024, and Kenya's Communications Authority reported 2.54 billion cyber threat incidents in the first quarter of 2025. That's why the government tightened the rules.

What actually changed

The new law addresses cyber fraud, digital terrorism, identity theft, and harmful online content. Three changes matter most for business owners.

SIM-swap fraud is now explicitly banned. The amendment introduces clearer definitions of identity theft that specifically include misuse of SIM cards, and SIM-swapping fraud—where criminals convince telecoms operators to transfer a victim's number to a SIM under criminal control—was a grey area under the 2018 Act. It is not any more.

Phishing covers voice calls, not just emails. Phishing through fraudulent emails is explicitly recognised, and so are fraudulent voice calls—a provision targeting "vishing" (voice phishing). Your staff are targets. Scammers call posing as your bank or supplier and trick people into handing over credentials or transferring funds.

The government can now block websites and apps. The amendment expanded NC4's (the National Computer and Cybercrimes Coordination Committee) authority to make websites or applications promoting unlawful activities inaccessible. This matters if you operate online services or partner with platforms.

The penalties

Fines range from KSh 300,000 to KSh 20 million and imprisonment spans from 6 months to 10 years. Specific offences carry specific maxima: unauthorised access to a computer carries a maximum fine of KSh 2 million or 3 years in prison; cyber harassment carries up to KSh 20 million or 10 years; identity theft and phishing each carry up to KSh 5 million or 7 years.

These are not traffic fines. A single breach can end a business career and wipe out an executive personally.

What you should do now

Start with your staff. Cyber harassment occurs when someone communicates with another person in a manner that they know, or ought to know, could cause harm. Email, Slack, WhatsApp, LinkedIn—all count. Make sure your team understands this is now much stricter.

Audit your customer data handling. Any unauthorised access to customer information—whether by an insider, a hacker, or even an old employee with lingering login access—is a criminal matter, not just a compliance headache. Accessing computer systems or data without authorisation is prohibited.

Check your payment systems and banking integrations. SIM-swap fraud, phishing, and identity theft offences apply to your suppliers and customers too. If a supplier gets compromised and uses that to access your accounts, both they and you could face questions.

If you handle payments online, document it. Keep records of who accesses what, when, and why. The law's investigation procedures are broad and courts can demand disclosure of data and traffic logs. An experienced legal advisor on Kaziiko can help you set up documentation that protects you if something goes wrong.

Consider cyber insurance. Kenya's insurance market has products for data breach liability and business interruption from cyberattacks. Check what your current policies cover.

A note on what's still unclear

In March 2026, Kenya's top court struck down sections 22 and 23 on false publications, saying they were too vague—a win for free speech. This means if you publish information online (blog posts, product claims, client testimonials), the old "false publications" charge may not stick. But the court upheld cyber harassment rules, so tone still matters.

Also note: the law applies to conduct that targets Kenyans or Kenyan property, even if you're based elsewhere. If your business operates online and has Kenyan users, you're covered.

The full law is technical and covers many other offences—from cyber espionage to data interference to computer forgery. If your business involves technology, data, or finance, get a verified Kenyan legal expert on Kaziiko to review your systems and policies now rather than after an incident.

Frequently Asked Questions

What counts as cyber harassment?

Cyber harassment occurs when someone communicates with another person in a manner that they know, or ought to know, could cause harm. This includes email, messages, calls, and social media posts. Penalties reach KSh 20 million and 10 years in prison.

Can my staff be held personally liable?

Yes. The law applies to individuals, not just companies. An employee who commits an offence—whether phishing, sending harassing messages, or accessing data without permission—faces criminal charges personally. Your company may also be liable. Talk to your staff about this risk.

What should I do if I suspect a cyber attack?

Report it immediately to the National Computer and Cybercrimes Coordination Committee (NC4), the Communications Authority, and the Directorate of Criminal Investigations (DCI). Document everything. If customer data was involved, tell them and your insurance company. Consider consulting a government services expert on Kaziiko for guidance on the reporting process.

Does the law apply if my business is not in Kenya?

If your business has Kenyan users, customers, or operates on Kenyan networks, yes. The law aligns cooperation with mutual legal assistance and extradition frameworks, and extends jurisdiction in defined circumstances where conduct outside Kenya targets Kenyan persons, property, or interests.