Kenya

Kenya has not enacted an AI-specific statute. The Artificial Intelligence Bill, 2026, a Senate bill gazetted 19 February 2026 and read a first time in the Senate on 2 April 2026, would classify systems by risk, prohibit unacceptable-risk systems outright, and impose transparency, human-oversight and synthetic-media-labelling duties on providers and deployers of higher-risk systems, but it binds nobody yet.

Kenya's National Artificial Intelligence Strategy 2025-2030, launched by the Ministry of Information, Communications and the Digital Economy on 27 March 2025, is a policy document guiding future legislation rather than a source of enforceable obligations, and the Kenya Bureau of Standards' draft AI code of practice remains an unconfirmed, voluntary standard.

Kenya's comprehensive personal-data regime is the Data Protection Act, 2019, which establishes the Office of the Data Protection Commissioner and binds every data controller or processor operating in Kenya or handling the data of a person located in Kenya, whether or not the underlying personal data is otherwise publicly accessible.

The Act treats biometric, genetic, health and several other categories as sensitive personal data carrying heightened processing conditions, requires a controller to verify a child's age and obtain a parent or guardian's consent before processing a child's personal data, and gives every data subject a right against a decision based solely on automated processing that produces a legal or similarly significant effect.

Cross-border transfer requires proof of safeguards to the Commissioner or the data subject's consent, and the Cabinet Secretary may compel certain categories of processing onto a server located in Kenya.

The Data Protection (General) Regulations, 2021 add operational detail on personal data breach notification, data protection impact assessments and data-subject-request timelines, and the Commissioner may impose an administrative fine of up to five million Kenya shillings, or one per cent of an undertaking's annual turnover if lower, alongside criminal penalties for specific offences.

Kenya has no scraping-specific statute, so general law governs each dimension separately. The Computer Misuse and Cybercrimes Act, 2018 criminalises unauthorised access to a computer system, but section 14 requires infringing a security measure to gain access, so scraping a public, unauthenticated page without defeating an access control does not fit a plain reading of that requirement, and no reported case has tested the point.

No Kenyan court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper. The Copyright Act, 2001 permits fair dealing for scientific research, private use, criticism or review, and the reporting of current events, and gives a right to quote, but Kenya has not enacted a text-and-data-mining exception, so training a model on scraped copyrighted text rests only on the general fair-dealing ground if it can be characterised as scientific research.

Kenya's copyright statute confers no sui generis database right, and its related rights cover only broadcasts, sound recordings and performances.

The Data Protection Act, 2019 applies to personal data without a general carve-out for information that is publicly accessible, so scraping personal data from a public Kenyan website remains subject to the Act's lawful-basis, purpose-limitation and cross-border-transfer duties, and a narrower processing ground exists only for sensitive personal data the data subject has manifestly made public.

No Kenyan statute or reported case establishes a scraping-specific unfair-competition, misappropriation or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

Kenya's Computer Misuse and Cybercrimes Act, 2018 (Act No. 5 of 2018, Cap. 79C) sets a general cyber-incident reporting duty, in section 40, on any person who operates a computer system or a computer network in Kenya, whether public or private: within twenty-four hours of an attack, intrusion, or other disruption to the functioning of another computer system or network, the operator must inform the National Computer and Cybercrimes Co-ordination Committee, and failing to do so is itself an offence carrying a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both.

Because that duty binds any operator of a computer system rather than a licensed or sector-specific status, it reaches an ordinary developer operating a website, app, or online service with a Kenya nexus, and the row is filed and flagged on that basis.

Separately, Part II of the same Act (sections 4 through 13) creates Kenya's critical-information-infrastructure regime: the Director of the Committee designates, by Gazette notice, which systems are "critical infrastructure", meaning a system whose disruption would interrupt a life-sustaining service, harm the economy, cause massive casualties, disrupt the money market, or severely affect national security; only the owner or operator of a system so designated carries the Act's further critical-infrastructure duties, including an annual compliance report and audit under section 13, with a penalty on conviction of a fine of up to two hundred thousand shillings or imprisonment of up to five years, or both, for an owner who fails to file or cooperate.

The Computer Misuse and Cybercrime (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice No. 44 of 2024) operationalise that regime: an owner of designated critical information infrastructure must conduct an annual cyber-risk assessment and business impact analysis, submit a risk register to the Committee, designate a Chief Information Security Officer, and report a cybersecurity incident to the relevant Sectoral Cybersecurity Operations Centre within twenty-four hours of becoming aware of it.

Because that whole regime binds only an owner or operator the Director has individually designated by Gazette notice into one of the Regulations' named critical-infrastructure sectors, rather than a status any declared LexLint activity can express, it is recorded here rather than raised against a declared activity, the same treatment this profile gives Singapore's critical-information-infrastructure regime, Japan's designated critical-infrastructure operators, and New York's Department of Financial Services Part 500 covered entities.

The State Corporations (National Cybersecurity Agency) Order, 2026 (Legal Notice No. 89 of 2026, in effect from 15 May 2026) separately establishes a new National Cybersecurity Agency as the autonomous body coordinating national cybersecurity policy and auditing the cybersecurity resilience of designated critical information infrastructure; its own text creates no duty running to an undesignated private business, so it is named here as background rather than filed as an instrument.

No enacted Kenyan statute sets security requirements a software product or connected device must meet before or after it is placed on the market, so the product-requirements research dimension is a researched absence.

No general reasonable-security or information-security-programme statute reaches a business simply because it holds personal data; the nearest analogue is the Data Protection Act, 2019 sections 41 and 42, the technical-and-organisational-measures duty inside that comprehensive regime, an article this jurisdiction's privacy row already researches, the same architecture as General Data Protection Regulation (GDPR) Article 32, so it is not repeated here.

The same Act's breach-notification duty, section 43 (notice to the Data Commissioner within seventy-two hours and to the affected data subject), is likewise this jurisdiction's privacy-topic finding rather than restated here. No published enforcement record specific to section 40 is confirmed in the primary text.

Kenya has not enacted a law that specifically imposes age-verification duties on adult-content services, social media platforms or app stores, and has no age-appropriate design code enacted as a statute.

The Communications Authority of Kenya has instead issued Industry Guidelines for Child Online Protection and Safety, made under its consumer-protection regulations, which direct every ICT product and service provider whose products or services children may access, including social media and internet services, to develop and implement age-verification mechanisms without prescribing a particular method.

Separately, the Data Protection Act, 2019 requires a data controller or processor to obtain a parent or guardian's consent and to implement an age-verification mechanism before processing a child's personal data, a general data-protection duty rather than a platform-specific age-gating regime.

Kenya has no press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no reported hot-news or misappropriation doctrine, and no linking or framing case law reaching a news aggregator.

The general exception available to an aggregator is the Copyright Act, 2001's fair-dealing and quotation exception, which permits reproduction for scientific research, private use, criticism or review, and the reporting of current events, and gives a standalone right to quote, but Kenya has not enacted a machine-readable text-and-data-mining opt-out, so an aggregator's indexing is not addressed by any text and data mining (TDM)-specific rule either way.