Kenya protects data through a layered framework of statute, constitution, contract, and English-derived common law, without recognizing data as a standalone intellectual property category. The Copyright Act, 2001, enacted to align Kenya with TRIPS, protects compilations and databases as literary works where they show originality in selection or arrangement, and Section 35 makes infringement actionable with damages, injunctions and accounts. In Webtribe v. Jambopay Express (2017), the court protected a copied payment platform through trademark, breach of confidence (arising in equity — no NDA existed) and passing off; the judgment itself rested on confidence and trademark grounds rather than copyright.
Kenya has no dedicated trade secrets law; protection rests on common law, equity, and contract, with NDAs and confidentiality clauses the most practical tools — upheld in cases such as Safaricom v. Transcend Media Group (2020). The Data Protection Act, 2019 governs personal data processing under the Office of the Data Protection Commissioner, while the Computer Misuse and Cybercrimes Act, 2018 criminalizes unauthorized access to computer systems and databases. Constitutional guarantees of privacy (Article 31) and property, including IP (Article 40), underpin the framework.
AI-specific regulation remains nascent. The National ICT Policy, 2020 prioritizes AI development while calling for ethical data use, algorithmic transparency, and digital rights protections, and sectoral guidance on automated decision-making, profiling, and synthetic data is expected from the ODPC and the Communications Authority of Kenya. There is no sui generis database right, and while competition enforcement has not yet centered on data-dominance cases, the Competition Authority of Kenya is increasingly attuned to platform behavior and cross-border data flows within COMESA and Smart Africa regional frameworks.
Key takeaways
- Contracts and NDAs are the most practical and reliably enforced mechanism for protecting confidential data in Kenya.
- Kenyan courts protect misappropriated platforms and data primarily through equitable breach of confidence, as in Webtribe v. Jambopay (2017) — the judgment rested on confidence and trademark, not copyright.
- The Data Protection Act, 2019 imposes consent, security, and accountability obligations on those processing personal data.
- No trade secrets statute or sui generis database right exists, so layered contractual and technical safeguards are essential.
- AI governance is emerging through the National ICT Policy and expected sectoral guidance rather than binding legislation.
Primary legal instruments
AI-assisted summary of the report, editorially reviewed before publication · AI transparency
Protection mechanisms
Report-derived analysis per mechanism. The report text is fixed; committee members with contributor access can revise the rating (with an audit trail) and add notes below each block.
Recent Developments
Live updates contributed by committee members and the AI research bot — separate from the fixed report content above.
New Data Protection Guidelines for AI Vendors Issued
The Kenyan data protection regulator has reportedly issued new advisory guidelines specifically for AI vendors. These guidelines, while not legally binding, aim to provide direction on data protection throughout the generative AI lifecycle. They represent the regulator's current thinking on how to apply existing data protection principles to emerging AI technologies.
KECOBO Takes Administrative Action Against Copyright Management Organization
The Kenya Copyright Board (KECOBO) has initiated administrative action against KAMP Copyright and Related Rights Limited regarding its operating license. This development signifies the regulator's active role in overseeing collective management organizations within the copyright sector. It underscores KECOBO's commitment to ensuring compliance and proper functioning of entities managing copyright and related rights in Kenya.
KECOBO opens public consultation on Copyright and Related Rights Bill 2026, a full overhaul of Kenya's copyright law
The Kenya Copyright Board published the proposed Copyright and Related Rights Bill 2026 and invited public memoranda, with submissions due by 31 March 2026. The bill would replace the Copyright Act 2001 — the statute under which compilations and databases obtain copyright protection in Kenya — with stronger online enforcement tools and expanded Copyright Tribunal powers. Stakeholders such as KICTANet criticised the draft's silence on AI training and text-and-data-mining, urging that it be reconciled with the pending AI Bill before enactment.
Artificial Intelligence Bill 2026 tabled in Kenya's Senate, proposing first dedicated AI regulatory framework
The Artificial Intelligence Bill 2026 (Senate Bills No. 4) received its first reading on 19 February 2026, proposing an EU-style four-tier risk classification for AI systems, mandatory pre-deployment risk and human-rights impact assessments for high-risk systems, and universal disclosure duties covering a system's purpose, limitations and bias mitigation. It ties AI governance to the Data Protection Act 2019, requiring high-risk providers and deployers to run data protection impact assessments over training and operational data. Practitioners have flagged that the bill must be coordinated with the parallel copyright reform, since neither yet resolves the status of copyrighted works and datasets used to train AI.