Acceptable Use Policy (Kenya)

An Acceptable Use Policy (Kenya) is a formal organisational document that establishes the rules, permissions, and prohibitions governing how employees, contractors, and authorised users may access and use an organisation's information technology systems, networks, internet connections, email platforms, data repositories, and electronic devices. In Kenya, the primary statute governing cyber conduct and computer misuse is the Computer Misuse and Cybercrimes Act No. 5 of 2018, which criminalises unauthorised access to computer systems, unlawful interception of data, cyber fraud, cybersquatting, and publication of false information through computer systems.

Section 3 of the Computer Misuse and Cybercrimes Act No. 5 of 2018 establishes the offence of unauthorised access to a computer system, carrying a penalty of up to KES 5,000,000 or imprisonment for up to three years or both. Section 4 addresses access with intent to commit a further offence, while Section 5 prohibits unauthorised interference with computer systems. An Acceptable Use Policy sets the boundary between authorised and unauthorised use within an organisation — conduct that falls outside the policy's permitted scope can support both internal disciplinary action under the Employment Act No. 11 of 2007 and criminal prosecution under the Computer Misuse and Cybercrimes Act.

The Data Protection Act No. 24 of 2019, enforced by the Office of the Data Protection Commissioner (ODPC), imposes statutory duties on data controllers and data processors to implement appropriate technical and organisational measures to protect personal data. Section 41 of the Data Protection Act requires data controllers registered with the ODPC to implement information security policies. An Acceptable Use Policy is one of the key organisational measures that demonstrates compliance with the data protection accountability principle under Section 25 of the Data Protection Act No. 24 of 2019. Failure to implement adequate security policies exposes the organisation to enforcement action by the ODPC, including administrative fines and public reprimands.

The Communications Authority of Kenya (CA), established under the Kenya Information and Communications Act (Cap. 411A), regulates internet service providers and telecommunications networks in Kenya. Organisations that provide internet access to employees are, in effect, secondary access providers and bear responsibility for confirming that access is used lawfully. The CA's Cybersecurity Regulations 2022 require internet service providers and operators of critical information infrastructure to maintain security policies — an Acceptable Use Policy forms part of the broader cybersecurity framework.

Beyond criminal and regulatory exposure, an Acceptable Use Policy serves essential employment law functions in Kenya. Under Section 41 of the Employment Act No. 11 of 2007, an employer must conduct a fair disciplinary process before terminating employment for misconduct. The Employment and Labour Relations Court (ELRC) has held in multiple decisions that an employer cannot rely on IT misuse as grounds for summary dismissal under Section 44 of the Employment Act without evidence that: the employee was aware of the applicable IT conduct standards; the employee was issued with a show-cause letter; and a disciplinary hearing was conducted. An Acceptable Use Policy that has been communicated to the employee and acknowledged in writing provides the foundational evidence for a fair disciplinary process.

For organisations processing sensitive categories of data — health records, financial data, or data relating to children — an Acceptable Use Policy must additionally address obligations under the Children Act No. 29 of 2022 and any sector-specific data handling standards issued by the Central Bank of Kenya (CBK) for financial institutions or the Communications Authority of Kenya (CA) for telecommunications operators. The Kenya National Bureau of Statistics (KNBS) and the Kenya Revenue Authority (KRA) maintain separate data protection standards for organisations that interface with government data systems.

An Acceptable Use Policy (Kenya) is required whenever an organisation provides employees, contractors, or third parties with access to its IT systems, and several situations make implementation urgent.

An Acceptable Use Policy is required when a company registered with the Business Registration Service (BRS) hires employees who will use company-provided computers, smartphones, email accounts, or internet access. Without a written policy communicated to employees before or at commencement of employment, the organisation has limited recourse if employees misuse IT resources — visiting inappropriate websites, exfiltrating customer data, or using company devices for personal business activities.

An Acceptable Use Policy is needed when an organisation handles personal data of Kenyan residents and is required to register with the Office of the Data Protection Commissioner (ODPC) as a data controller or data processor under Section 19 of the Data Protection Act No. 24 of 2019. The ODPC's enforcement framework includes the power to issue compliance orders, conduct audits, and impose penalties. A documented Acceptable Use Policy is cited in ODPC guidance as a baseline organisational measure that every registered data controller should maintain.

An Acceptable Use Policy is required when an organisation discovers or suspects that an employee has committed a computer-related offence under the Computer Misuse and Cybercrimes Act No. 5 of 2018 — such as accessing customer databases without authorisation or forwarding confidential information to a competitor. The policy establishes the internal conduct standard against which the employee's behaviour is assessed in disciplinary proceedings before the ELRC.

An Acceptable Use Policy is needed when a company operates remote-working arrangements — increasingly common across Nairobi's technology and professional services sector — where employees access corporate systems from personal devices or home networks. The policy addresses bring-your-own-device (BYOD) risks, virtual private network (VPN) requirements, and obligations to report security incidents.

An Acceptable Use Policy is required for schools, universities, hospitals, and government agencies in Kenya that provide internet access to students, patients, or the public, particularly given the CA Cybersecurity Regulations 2022 requirements for operators of public access networks.

Parties in Kenya should prepare a Acceptable Use Policy (Kenya) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act No. 17 of 2015, the Registrar of Companies at the Office of the Attorney General maintains the register of Kenyan companies. Section 3 of the Law of Contract Act (Cap. 23) governs contractual obligations. The Competition Authority of Kenya (CAK) enforces the Competition Act No. 12 of 2010. The Kenya Revenue Authority (KRA) administers corporate tax under the Income Tax Act (Cap. 470). The High Court of Kenya has unlimited original jurisdiction under Article 165 of the Constitution of Kenya 2010. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A thorough Acceptable Use Policy (Kenya) under the Computer Misuse and Cybercrimes Act No. 5 of 2018 must include the following elements to be effective and enforceable.

Scope and Covered Systems: A precise definition of the IT systems, devices, networks, software platforms, cloud services, and data covered by the policy — including company-owned hardware, licensed software, corporate email accounts, cloud storage (such as Google Workspace or Microsoft 365 tenancies), and any third-party systems accessed through single sign-on credentials. The scope section should distinguish between company-owned devices and personal devices used to access company systems (BYOD).

Authorised Use: A clear statement of what employees and authorised users are permitted to do — accessing systems for legitimate work purposes, using approved software tools, sending business-related communications, and storing work files on approved platforms. Limited personal use may be permitted during breaks, subject to the conditions specified in the policy.

Prohibited Conduct: A specific list of prohibited activities referencing offences under the Computer Misuse and Cybercrimes Act No. 5 of 2018: unauthorised access to restricted systems (Section 3); interception of data (Section 7); cyber fraud (Section 14); publication of false information (Section 22); cybersquatting (Section 29); and sending unsolicited communications (Section 28). Additional prohibitions should address: downloading unlicensed software; accessing adult, gambling, or illegal content; mining cryptocurrency on company systems; and sharing login credentials.

Data Protection Obligations: Employee duties under the Data Protection Act No. 24 of 2019 and the ODPC's data subject rights framework — including obligations to handle personal data lawfully, to report data breaches promptly to the organisation's data protection officer, and to store personal data only on approved systems with appropriate access controls.

Email and Communication Standards: Rules governing the use of corporate email — prohibiting phishing, spam distribution, and dissemination of offensive content — and the organisation's right to monitor business communications subject to the Data Protection Act No. 24 of 2019. Reference to the National Cybersecurity Strategy 2022–2027 published by the Ministry of Information, Communications and the Digital Economy.

Security Obligations: Password standards (minimum length, complexity, rotation frequency), screen-locking requirements, mandatory use of VPN on public networks, prohibition on connecting unauthorised USB devices, and obligation to install approved security updates promptly.

Incident Reporting: The employee's duty to report any suspected security incident, data breach, lost device, or unusual system behaviour to the IT department or data protection officer within a specified timeframe — supporting the organisation's obligation under Section 43 of the Data Protection Act No. 24 of 2019 to notify the ODPC of personal data breaches within 72 hours.

Consequences of Breach: A statement that violations of the policy constitute misconduct under the Employment Act No. 11 of 2007, subject to disciplinary action up to and including summary dismissal under Section 44, and that criminal conduct may be referred to the Directorate of Criminal Investigations (DCI) and the DPP for prosecution under the Computer Misuse and Cybercrimes Act No. 5 of 2018.

Acknowledgment and Review: A signed employee acknowledgment section confirming that the employee has read, understood, and agrees to comply with the policy. Forms-legal.com provides this Acceptable Use Policy template as a practical starting document for Kenyan organisations implementing cybersecurity governance frameworks.

The policy should be reviewed annually or whenever the Computer Misuse and Cybercrimes Act No. 5 of 2018 is amended, the Data Protection Act No. 24 of 2019 regulations are updated, or the Communications Authority of Kenya issues new cybersecurity guidance.