2 min read369 words
Running an e-commerce platform, a SaaS product, or even a business WhatsApp group in Kenya creates legal obligations many founders are unaware of. The Computer Misuse and Cybercrimes Act 2018 (CMCA) is more far-reaching than most people realise.
What the CMCA covers
The CMCA creates offences relating to: unauthorised access to computer systems (Section 4); access with intent to commit a further offence (Section 5); unauthorised interference with data (Section 7); cyber espionage (Section 10); wrongful distribution of obscene or intimate images (Section 27); publication of false information (Section 22); and interception of communications (Section 11).
Obligations for online businesses
- Website Terms and Conditions — clearly state permitted uses, prohibited conduct, and your rights to terminate access. Without these, enforcing against misuse is harder and your liability exposure is broader.
- Privacy Policy — mandatory under the Data Protection Act 2019. Must disclose what data you collect, why, legal basis, how long you keep it, and users' rights.
- Data breach response plan — under the DPA 2019, you must report breaches to the ODPC within 72 hours. Without a documented plan, you will likely miss this window.
- Cookie consent — tracking cookies require informed consent under DPA 2019. Pre-ticked boxes are not valid consent.
- Content moderation — platforms that host user-generated content should implement moderation policies. The CMCA Section 22 creates liability for publishing false information — though court decisions on third-party platform liability are still developing.
Section 22 of the CMCA (publishing false information with intent to deceive) was challenged before the High Court in Bloggers Association of Kenya v Attorney General (2020) . The court declared Section 29 of the old Kenya Information and Communications Act unconstitutional, and while Section 22 of the CMCA survived with courts apply it narrowly.
However, businesses should be cautious about misleading marketing claims and user-generated content as civil liability under the Consumer Protection Act 2012 is a parallel risk.
Penalties
Penalties under the CMCA range from KES 200,000 and/or 2 years’ imprisonment for basic unauthorised access, up to KES 10 million and/or 25 years’ imprisonment for cyber espionage or attacks on critical infrastructure.
Is your digital business legally protected?
We draft website terms, privacy policies, data processing agreements, and conduct digital compliance audits. Contacts us today.
Talk to Gallant before you make the decision
If this raises a question specific to your situation, we are glad to talk it through.
This article is general legal information, not legal advice, and does not create a lawyer–client relationship.