Cybercrime offences and penalties (Computer Misuse and Cybercrimes Act)
Computer Misuse and Cybercrimes Act; Directorate of Criminal Investigations · sources read 4 Oct 2026
The Computer Misuse and Cybercrimes Act makes hacking, computer fraud, identity theft, phishing and child pornography crimes. Penalties run from fines of up to KSh 200,000 to KSh 20 million and up to 25 years in jail; report cybercrime to the police or DCI.
- Where
- Report cybercrime at any police station or DCI office. The Act itself is on Kenya Law (kenyalaw.org).
Steps
- Hacking (getting into a computer system you're not allowed into): up to KSh 5 million, 3 years in jail, or both. With intent to commit another crime: up to KSh 10 million, 10 years, or both.
- Computer fraud (using a computer to unlawfully gain or cause someone loss): up to KSh 20 million, 10 years, or both.
- Identity theft (using someone else's password, e-signature or other ID feature): up to KSh 200,000, 3 years, or both. Phishing for personal details: up to KSh 300,000, 3 years, or both.
- If you are a victim, report at the nearest police station or DCI office. DCI investigates electronic fraud, unauthorised access and similar cyber crimes.
Watch out
- Intercepting someone's electronic messages or money transfers carries up to 7 years in jail, a fine of up to KSh 200,000, or both.
- Child pornography offences carry the heaviest penalty: up to KSh 20 million, 25 years in jail, or both.
- Interfering with a computer system or data without permission (for example deleting or altering it) is a separate offence: up to KSh 10 million, 5 years, or both.
Who this covers
- Everyone in Kenya who uses a phone, computer or the internet, and anyone who is a victim of a cybercrime.
Official sources (2)
- Computer Misuse and Cybercrimes Act (Cap. 79C), version 31 December 2022 new.kenyalaw.org · read 4 Oct 2026
- Investigative Services dci.go.ke · read 4 Oct 2026