How does the law handle international cybercrime from outside Kenya?

The Act has extraterritorial reach — it applies if the effect is felt in Kenya or the victim is Kenyan. Kenya can request mutual legal assistance internationally, though cross-border prosecutions depend on cooperation from the other country.

8.08.2026

Kenya’s Computer Misuse and Cybercrimes Act 2025: New Penalties, New Offences and Your Rights

Q: Is sharing someone's private photos online a crime under Kenyan law?

Yes. Sharing intimate images without consent falls under cyber harassment provisions. The 2025 amendments carry a fine of up to KES 20 million or 10 years imprisonment. Preserve evidence and report to DCI.

Q: Can I be arrested for posting a criticism of the government online?

This is legally contested. The High Court issued conservatory orders suspending enforcement of provisions on 'false information' pending a constitutional challenge. Free expression under Article 33 remains a defence.

Q: Someone hacked my M-Pesa account. What do I do first?

Immediately call Safaricom's helpline to suspend your SIM, notify your bank, and report to DCI's Cybercrime Unit. Preserve all transaction records. Speed is critical for fund recovery.

Q: Can police seize my phone without a warrant under the Cybercrimes Act?

Generally no. Article 31 of the Constitution protects privacy of electronic devices. Police ordinarily need a court order. Evidence seized without a warrant may be inadmissible.

Q: I run an online marketplace. Am I liable for scams on my platform?

The Act recognises limited intermediary liability — platforms are generally not liable for user-generated content unless they had actual knowledge of illegal activity and failed to act. Compliance with court-ordered takedowns is mandatory.

Q: What is the difference between cyber harassment and cyber fraud under the Act?

Cyber harassment involves conduct causing distress or fear. Cyber fraud involves deception for financial gain. Both are serious offences with different elements, defences and reporting pathways.

Q: Is a security researcher protected from prosecution under the Cybercrimes Act?

Yes, if authorised in writing. Section 18 exempts authorised testing from hacking offences. The authorisation must be explicit, documented and scoped to specific systems. Any activity outside the written scope remains potentially criminal.

Criminal Law

15 Oct 2025
President signed
the amendment

KES 20M
Maximum fine for
cyber harassment

10 yrs
Maximum prison term
for serious offences

KES 10.7B
Lost to cybercrime
in Kenya — 2023

⚖️ Laws & Official Sources

What Changed in October 2025

Kenya’s digital crime landscape changed fundamentally on 15 October 2025. That day, President William Ruto signed the Computer Misuse and Cybercrimes (Amendment) Act, 2025 into law — a sweeping revision of the 2018 framework that governs online crime in Kenya.

The original Computer Misuse and Cybercrimes Act, 2018 (Cap. 79C) was Kenya’s first serious attempt at comprehensive cybercrime legislation. It addressed hacking, unauthorised access, and cyber harassment — but the digital world had moved on. By 2023, Kenyans had lost an estimated KES 10.71 billion to cybercriminals. SIM card fraud, virtual asset theft, AI-generated impersonation, and sophisticated phishing attacks had created gaps that the 2018 law could not adequately address.

The 2025 amendments targeted those gaps directly. But they also introduced provisions that have drawn serious constitutional challenges — which means understanding what is in force right now, and what is not, requires more than reading the gazette.

📌 Critical Point: Some Provisions Are Currently Suspended

In October 2025, shortly after the President’s signature, multiple petitioners — including Reuben Kigame and the Kenya Human Rights Commission — filed constitutional petitions challenging sections of the amended Act. The High Court issued conservatory orders suspending specific provisions pending the full hearing. This guide identifies which provisions are disputed. Where in doubt, seek legal advice before relying on or challenging enforcement of those sections.

New and Expanded Offences

The 2025 amendment introduced several new categories of offence and expanded definitions of existing ones:

1. Cyber Harassment With Expanded Scope

Section 27 of the principal Act has been amended to cover online conduct that is “likely to cause a person to commit suicide.” Previously, the section addressed harassment and distress more generally. The expanded definition responds directly to documented cases of cyberbullying leading to self-harm. This is one of the most emotionally charged provisions — and one where evidence standards matter enormously in determining what crosses the legal threshold.

2. Identity Theft — Explicit SIM Card Coverage

The 2025 amendment introduces a clearer definition of identity theft that specifically includes misuse of SIM cards, bank cards, and digital accounts. SIM-swapping fraud — where criminals convince telecoms operators to transfer a victim’s number to a SIM under criminal control — was a grey area under the 2018 Act. It is not any more.

3. Phishing Through Voice and Email

Phishing through fraudulent emails is explicitly recognised. Critically, so are fraudulent voice calls — a provision targeting “vishing” (voice phishing), a growing problem where callers impersonate bank officials, KRA officers, or government agents to extract money or credentials.

4. Virtual Assets and Crypto Fraud

Virtual assets (cryptocurrencies, digital tokens) are now expressly within the scope of computer-related fraud provisions. This removes a previous ambiguity that defence advocates sometimes exploited to argue that cryptocurrency theft was not covered by the existing law.

5. Court-Ordered Takedowns

Courts can now order internet service providers and platforms to remove harmful content or deactivate criminal websites. This is a significant expansion of judicial power over online content — and the provision most likely to generate free-expression concerns in enforcement.

Penalty Table: Offence by Offence


Offence	Maximum Fine	Maximum Imprisonment
Unauthorised access to a computer system	KES 2 million	3 years
Unauthorised access with intent to commit a further offence	KES 5 million	7 years
Cyber harassment (post-2025 amendment)	KES 20 million	10 years
Identity theft / misuse of credentials, SIM cards, bank cards	KES 5 million	7 years
Phishing (email or voice)	KES 5 million	7 years
Creating fake websites or fraudulent pages	KES 7 million	7 years
Cyber fraud (including virtual asset fraud)	KES 10 million	10 years
Hacking / unauthorised computer manipulation	KES 5 million	7 years
Publication of false information (contested — see below)	KES 5 million	2 years
Aiding or attempting any of the above	KES 7 million	4 years

Note: Fines may be imposed alternatively or cumulatively with imprisonment depending on the severity of the offence and the court’s assessment. The figures above represent maximums — actual penalties vary by circumstances.

The Suspended Provisions: What Is Not Currently Enforceable

This is the section most commentary misses. The 2025 amendments are not a monolithic law that is either “in force” or “not in force.” Specific provisions have been the subject of constitutional challenges, and the High Court issued conservatory orders suspending their enforcement pending final determination.

The provisions most heavily challenged relate to:

Publication of false information — Critics argue the definition of “false” is too broad and could be used to criminalise journalism, satire and political commentary.
Government and state agency powers to monitor and intercept content — Petitioners argue some surveillance authorisations conflict with Article 31 (right to privacy) and lack adequate judicial oversight.
Expanded definitions of offensive online communication — The scope of what constitutes an offence under certain amended provisions has been challenged as disproportionately wide.

⚠️ Legal Uncertainty Is a Two-Way Problem

If you are accused of an offence under a suspended provision, the suspension does not make you automatically immune — courts assess each situation and the High Court may lift the suspension. If you are a victim of conduct covered by a suspended provision, enforcement options are limited until the High Court issues its final ruling. Both situations require current legal advice — not a general reading of the Act.

What Businesses Must Do Now

Review and update your data security policies

The 2025 amendments impose obligations on businesses to report certain cyber incidents and to cooperate with law enforcement. Ensure your cybersecurity policy reflects current law, including data breach notification procedures.

Update employment contracts to cover cyber misuse

Employees who misuse company systems, access client data without authorisation, or use company infrastructure for personal cybercrime activity can expose both themselves and the company to liability. Employment contracts and IT policies should explicitly define acceptable use and the consequences of violation.

Train staff on phishing and vishing recognition

Phishing through fraudulent emails and voice calls is now explicitly criminalised — but your staff are still the target. Regular training reduces the risk of your business being the victim. It also reduces the risk of an employee inadvertently facilitating a crime by sharing credentials in response to a fraudulent call.

Understand your obligations on content takedown requests

If your business hosts user-generated content (social media, forums, marketplace platforms), you may receive court-ordered takedown requests under the new provisions. Establish a process for receiving, verifying and responding to such orders promptly — and for retaining records of your response.

Register penetration testing activities correctly

Section 18 of the principal Act exempts authorised security testing from the offence of possessing hacking tools. If your business conducts or contracts penetration testing, ensure the engagement is documented with written authorisation. Without documentation, testers can face prosecution even when their work is legitimate.

Facing cybercrime charges or need to report a cyberattack?

Criminal law advocates at Lawyers-ke.com can advise you on offence definitions, defend you against charges under the Cybercrimes Act, or guide victims through the reporting and evidence-preservation process.

Find a Criminal Law Advocate →

If You Are a Victim: Steps to Take

Kenya’s cybercrime reporting and investigation infrastructure has improved since 2018 — but the quality of your own evidence-gathering in the immediate aftermath of an attack often determines whether a prosecution succeeds.

Preserve everything — do not delete anything

Screenshots of harassing messages, fraudulent communications, suspicious account activity. The temptation to delete harmful content is understandable but counterproductive. Courts need evidence. Preservation includes metadata — screenshot the full message thread, including timestamps, sender addresses and profile information.

Report to the Directorate of Criminal Investigations (DCI)

The DCI’s Cybercrime Unit handles cybercrime reports. File a report as soon as possible. Include all preserved evidence and a clear timeline of events. Request a reference number — you will need this for follow-up.

Report to ke-CIRT for technical incidents

The Kenya Computer Incident Response Team (ke-CIRT, at ke-cirt.go.ke) handles reports of hacking, data breaches, and network intrusions. For business victims, reporting to ke-CIRT in parallel with DCI strengthens your case and may trigger faster technical response.

Notify your bank immediately for financial fraud

If SIM-swap fraud or mobile banking fraud is involved, contact your bank’s fraud line within hours. Banks have internal recovery windows — funds moved to intermediary accounts can sometimes be recalled if the bank is notified before the withdrawal chain is complete.

Consult a criminal law advocate before giving statements

Victims who give statements to investigators without legal guidance sometimes inadvertently complicate their own case — or fail to mention information that would strengthen it. An advocate who specialises in cybercrime can help you structure your account and ensure the investigators follow the procedures the Act requires.

If You Are Accused: Your Rights

Being investigated or charged under the Computer Misuse and Cybercrimes Act is serious. The penalties are heavy, digital evidence is often complex, and prosecution strategies in cybercrime cases frequently rely on technical evidence that most accused persons cannot adequately assess without specialist help.


Your Constitutional Right	What This Means in a Cybercrime Case
Right to remain silent (Art. 50(2)(i))	You are not required to answer police questions before you have had access to legal representation. Anything you say can be used against you.
Right to an advocate (Art. 50(2)(g))	You have the right to choose your own advocate and to be represented at all stages. If you cannot afford one, the court may appoint one at state expense for serious charges.
Right to reasonable bail/bond (Art. 49(1)(h))	Cybercrime charges do not automatically disqualify you from bail. However, where there is evidence of ongoing harm or flight risk, prosecutors will argue for detention. An advocate can make the bail application more effectively.
Right to be informed of the offence (Art. 49(1)(a))	Officers must inform you promptly of the specific provision you are alleged to have violated. Vague or shifting accusations are grounds for a challenge.
Right to challenge evidence (Art. 50(2)(j))	Digital forensic evidence must be gathered and handled according to established procedures. Evidence obtained through unlawful surveillance, warrantless searches, or improper handling can be challenged as inadmissible.

📋 The Tool-Use Defence: What Section 18 Covers

One of the most misunderstood aspects of the Cybercrimes Act is Section 18 of the 2018 principal Act, which is retained in the 2025 amendment. It provides that possession of hacking tools — software programs or access codes designed to gain unauthorised access — is not an offence where the act was “intended for authorised training, testing, or the protection of a computer system.” This creates a legitimate space for cybersecurity professionals. The critical word is “authorised” — verbal permission from a client does not suffice if it is ever challenged. Written authorisation, scoped to specific systems and time periods, is what Section 18 requires in practice.

Frequently Asked Questions

Is sharing someone’s private photos online a crime under Kenyan law?

Yes. The sharing of intimate images or private photographs without consent falls under cyber harassment provisions of the Computer Misuse and Cybercrimes Act. The 2025 amendments strengthened the harassment provisions. Depending on the circumstances and the harm caused, the offence can carry a fine of up to KES 20 million or 10 years in prison. Victims should preserve all evidence of the sharing and report to DCI and, where relevant, to the platform hosting the content.

Can I be arrested for posting a criticism of the government online?

This is genuinely contested. The 2025 amendments include provisions on “false information” that critics argue could be used to target government critics and journalists. The High Court issued conservatory orders suspending enforcement of those specific provisions pending a constitutional challenge. Until the High Court issues its final ruling, the situation remains legally uncertain. Free expression under Article 33 of the Constitution remains a powerful defence in any prosecution under these provisions.

Someone hacked my M-Pesa account. What do I do first?

Immediately call Safaricom’s M-Pesa helpline to report unauthorised transactions and request a temporary suspension of your SIM. Then report to your bank (if linked accounts are affected) and file a report with DCI’s Cybercrime Unit. Preserve all transaction records, notifications and any communications. Time is critical — the faster you act, the greater the chance of fund recovery and evidence preservation.

What is the difference between cyber harassment and cyber fraud under the Act?

Cyber harassment (Section 27) involves online conduct designed to cause distress, fear or alarm to a person — including threatening messages, doxxing, or content likely to cause self-harm. Cyber fraud involves using digital means to deceive a person for financial or material gain — phishing, fake websites, or SIM-swap schemes designed to steal money. Both are serious offences, but they have different elements, different defences and different reporting pathways.

Can police seize my phone without a warrant under the Cybercrimes Act?

Generally no. Article 31 of the Constitution protects the right to privacy of communications and electronic devices. While the Cybercrimes Act grants law enforcement broader powers to access and preserve electronic evidence, those powers are subject to judicial oversight — police must ordinarily obtain a court order. If your device was seized without a warrant or court order, challenge the seizure through your advocate as evidence obtained unlawfully may be inadmissible.

I run an online marketplace. Am I liable for scams that happen on my platform?

The Act recognises limited intermediary liability principles — platforms are generally not liable for user-generated content unless they had actual knowledge of the illegal activity and failed to act. However, if you receive a court-ordered takedown notice and fail to comply, you can face direct liability. Establishing clear terms of service, a fraud reporting mechanism and a process for responding to court orders is essential for any platform operating in Kenya.

How does the law handle international cybercrime — if the attacker is outside Kenya?

The Computer Misuse and Cybercrimes Act has extraterritorial reach — it applies to offences committed outside Kenya if the effect is felt in Kenya or if the victim is a Kenyan citizen. The Act also facilitates international cooperation, allowing Kenya’s Central Authority to request or provide mutual legal assistance to preserve and disclose electronic evidence across borders. In practice, international prosecutions are complex and depend heavily on the cooperation of the country where the attacker is located.

Is a security researcher protected from prosecution under the Cybercrimes Act?

Yes, if the research is properly authorised. Section 18 of the principal Act exempts authorised training, testing or protection activities from the offences of possessing or using hacking tools. “Authorised” means explicit, documented permission from the system owner — verbal consent is insufficient. The scope of the authorisation must match the scope of the testing. Any activity outside the written authorisation remains potentially criminal regardless of the researcher’s intent.

The Bottom Line

Kenya’s 2025 cybercrimes amendments represent real progress in closing gaps that criminals had exploited for years. SIM fraud, vishing, virtual asset theft — these are now unambiguously criminal acts with penalties that match their severity. For victims, the legal framework is stronger than it was before October 2025.

But the law also raises questions that courts have not yet fully answered. The balance between criminalising harmful online conduct and protecting free expression is not settled. The High Court’s final ruling on the constitutional challenge will shape how aggressively the more contested provisions are enforced. Businesses and individuals caught in that grey zone need current legal advice — not a reading of the statute alone.

The often-overlooked reality: most cybercrime cases in Kenya that reach prosecution do so because the victim gathered and preserved evidence well in the hours immediately after the attack. The advocate’s role in building a cybercrime case begins long before the courtroom — it starts with the first phone call after the crime is discovered. That call, made early and to the right person, is frequently the difference between justice and a closed file.

Victim of cybercrime — or facing charges?

Criminal law advocates on Lawyers-ke.com can guide you through DCI reporting, evidence preservation, bail applications and defence against Cybercrimes Act charges.

Find a Criminal Law Advocate — Free Search →

Sources

This article is for general informational purposes only and does not constitute legal advice. The Computer Misuse and Cybercrimes (Amendment) Act, 2025 is subject to ongoing constitutional challenges; some provisions may be suspended or modified by court order. Consult a qualified criminal law advocate for advice specific to your situation.

Select the city below to get to the lawyers on this topic.:

Cyber Harassment as a Criminal Offence: What Victims Can Do

In our increasingly connected world, the internet has become a vital part of daily life in Kenya. From staying in touch with loved ones to conducting business, its benefits are immense. However, this digital landscape also brings challenges, one of the most insidious being online abuse. If you’ve ever felt targeted, threatened, or humiliated through […]

7.05.2026

How to Respond When Police Execute an Unlawful Arrest

In a nation governed by the rule of law, the right to liberty is sacred. Yet, the unfortunate reality for many Kenyans is the experience of being subjected to an unlawful arrest. This can be a terrifying and disorienting ordeal, leaving victims feeling powerless and unsure of how to proceed. Understanding your rights and knowing […]

9.04.2026

When Police Searches Become Unlawful

The streets of Kenya are a vibrant tapestry of life, commerce, and community. In our daily lives, interactions with law enforcement are a normal part of maintaining order and security. The National Police Service is tasked with upholding the law, and part of their duty includes conducting searches when necessary to investigate crimes or ensure […]

22.03.2026

Defending Yourself Against False Accusations of Online Harassment

In our increasingly digital world, where professional networking, personal connections, and public discourse often unfold online, the threat of digital misrepresentation is a growing concern for young professionals in Kenya. Your online presence, meticulously built over years, can unfortunately become a target for malicious intent. One of the most insidious forms this can take is […]

1.03.2026

Defence Strategies for Youths Charged with Serious Offences

The news that your child has been charged with a serious offence can feel like a devastating blow, a nightmare from which you desperately wish to wake up. It’s a moment of profound fear, confusion, and despair for any parent or guardian in Kenya. The future you envisioned for your young one suddenly seems uncertain, […]

12.02.2026

Defending Yourself Against Cyber-Enabled Fraud Charges

In Kenya’s rapidly evolving digital landscape, technology professionals are at the forefront of innovation. Yet, this very position also places them at an increased risk of facing serious accusations, particularly those related to cyber-enabled fraud. The line between legitimate tech operations and perceived malicious intent can often be blurred, leading to dire consequences for individuals […]

29.01.2026

Wrongful Arrest or Detention: Steps to Defend Yourself

The thought of being arrested or detained can be frightening and disorienting. It’s a situation no one wants to find themselves in, yet it can happen to anyone. In Kenya, understanding your rights and knowing what steps to take if you face a wrongful arrest or detention is not just helpful; it’s absolutely crucial. This […]

21.12.2025

When Cybercrime Accusations Arise: Building a Solid Defence

The digital age has brought unprecedented opportunities for innovation, connection, and growth, particularly for Kenya’s vibrant young professionals and students. Yet, with these advancements comes an increased risk: the shadow of cybercrime. In an interconnected world, an accusation of cybercrime can emerge swiftly, threatening your reputation, career, and future. It’s a frightening prospect, but understanding […]

22.12.2025

Emergency Child Custody Orders Explained

The safety and well-being of our children are paramount. As parents, there are few things more terrifying than the thought of your child being in harm’s way, or facing circumstances that put their immediate future at risk. When such fears become a stark reality, knowing your legal options is not just helpful; it’s a lifeline. […]

25.03.2026

Medical Negligence in Rural Clinics: Rising Cases & Legal Options

It’s a feeling many of us in Kenya know well: the comfort of a familiar clinic, the trust we place in our local healthcare providers, especially in our rural communities where access can be challenging. We rely on them for our health, our children’s well-being, and often, our very lives. But what happens when that […]

17.01.2026

When KRA Freezes Your Business Account: Immediate Legal Steps

Imagine this: You wake up, ready to tackle the day, only to discover your business bank account has been frozen. Funds are inaccessible, payments are halted, and your entire operation grinds to a terrifying standstill. This isn’t just a nightmare scenario for Kenyan entrepreneurs; it’s a stark reality many face when the Kenya Revenue Authority […]

21.05.2026

Appealing a Denied Work Permit: What You Must Prepare

Navigating the immigration landscape in any country can be complex, and Kenya is no exception. For foreign professionals, securing a work permit is a critical step towards building a career and life here. However, receiving a denial can be disheartening and confusing. It’s crucial to remember that a denial isn’t always the final word. Understanding […]

9.01.2026

To all articles