Kenya

Summary

Kenya presents moderate crawling risk. The Computer Misuse and Cybercrimes Act No. 5 of 2018 (CMCA) s.14 criminalises intentional unauthorised access to a computer system; public pages carry implicit authorisation so the offence is unlikely to be triggered by crawling openly accessible content, but ignoring a robots.txt disallow or ToS prohibition can help establish unlawfulness. The 2024 Amendment Act (signed October 2025) added new offences for SIM-swap fraud and critical-information-infrastructure reporting but did not alter the s.14 unauthorised-access test materially. Some s.27 provisions (cyber harassment, false information) in the 2024 Act were suspended by court order in October 2025 pending constitutional review; s.14 is unaffected. The Data Protection Act No. 24 of 2019 (GDPR-inspired, actively enforced by the ODPC) applies to any collection of personal data including from publicly available sources — public availability does not exempt processing. The ODPC issued draft Conduct of Compliance Audit Regulations and a Data Sharing Code for consultation in December 2024. The Copyright Act No. 12 of 2001 protects original compilations; fair dealing is narrow (research, private use, criticism, news). No sui generis database right; no TDM exception. No scraping-specific case law exists. Kenya has NOT ratified the AU Malabo Convention.