Social Media Policy (Kenya)

A Social Media Policy in Kenya records the organisation's binding rules on the matter it addresses.

A Kenya Social Media Policy derives its legal foundation from several overlapping statutes. The Computer Misuse and Cybercrimes Act No. 5 of 2018 (CMCA) is the primary cybercrime statute in Kenya, administered by the National Computer and Cybercrimes Coordination Committee (NC4) under the Ministry of Information, Communications and the Digital Economy. The CMCA criminalises a range of online conduct relevant to social media use: Section 22 prohibits the publication of false information likely to cause public alarm or damage to reputation; Section 23 prohibits cyber harassment; Section 24 prohibits cyberstalking; Section 27 prohibits the publication of obscene material; and Section 33 prohibits the disclosure of passwords and access codes. An employee who violates these provisions while acting in connection with their employment may expose both themselves and the employer to criminal liability.

The Data Protection Act No. 24 of 2019 (DPA), administered by the Office of the Data Protection Commissioner (ODPC), governs the processing of personal data. Social media activity that involves sharing photographs, names, or other identifying information about colleagues, clients, or third parties constitutes processing of personal data under Section 2 of the DPA. An employee who posts such information without authorisation may breach the employer's obligations as a data controller under Section 25 of the DPA, and the employer may be liable to regulatory action by the ODPC.

The Employment Act No. 11 of 2007 governs the employment relationship in Kenya and underpins the disciplinary framework within which a Social Media Policy operates. Section 44 of the Employment Act lists gross misconduct, which includes wilful disobedience of a lawful and reasonable order given by the employer — such as an instruction not to disclose confidential business information on social media. Section 41 requires that before any disciplinary action is taken, the employee must be informed of the alleged misconduct and given a fair hearing.

The Defamation Act Cap. 36 and the common law of defamation as applied in Kenya through the courts govern false statements of fact that injure a person's or organisation's reputation. A social media post by an employee that makes false and defamatory statements about a competitor, supplier, client, or colleague may give rise to a defamation claim against both the employee and the employer under the principle of vicarious liability where the post was made in the course of employment.

The National Cohesion and Integration Act No. 12 of 2008 administered by the National Cohesion and Integration Commission (NCIC) prohibits hate speech and incitement to discrimination on social media platforms. Section 13 of the Act makes it an offence to use threatening, abusive, or insulting language that is likely to stir up ethnic hatred. Employees who post such content on personal social media accounts face prosecution under the NCIC Act, and the employer must have a policy making clear that such conduct is contrary to company values and will result in disciplinary action up to and including summary dismissal.

Kenya's Social Media Policy landscape is also shaped by the Kenya Information and Communications Act Cap. 411A, administered by the Communications Authority of Kenya (CA), which regulates electronic communications including content transmitted over online platforms. The CA has issued the Kenya Information and Communications (Consumer Protection) Regulations 2010 and the proposed Online Content Regulations that impose content moderation obligations on platform operators and, indirectly, on employers who operate branded social media accounts.

A Social Media Policy in Kenya is needed by every organisation that employs staff or engages contractors who use social media — which in practice means every business operating in the Kenyan market today. The ubiquity of smartphone use and mobile internet access in Kenya, with over 65% internet penetration and over 11 million active social media users according to the Communications Authority of Kenya's sector statistics, means that the risks of unregulated employee social media use are substantial.

A Social Media Policy is needed when a business wants to protect its confidential information and trade secrets. Employees routinely share information about clients, pricing, internal processes, and business strategies on personal social media accounts, sometimes without appreciating that such sharing constitutes a breach of their contractual duty of confidentiality. A clear policy, signed by the employee, establishes the legal basis for disciplinary action under Section 44 of the Employment Act No. 11 of 2007 and for a civil injunction to prevent further disclosure under the Law of Contract Act Cap. 23.

A Social Media Policy is required when a business operates branded social media accounts managed by employees. Without a policy, the business has no clear rules on who is authorised to post, what content is permissible, how complaints are handled, and what happens to account credentials when an employee leaves. Access disputes over company social media accounts have been litigated before the Employment and Labour Relations Court as intellectual property and employment claims.

A Social Media Policy is needed when an employer wants to manage reputational risk. A single employee post criticising a client, disclosing internal financial difficulties, or making offensive statements can go viral and cause lasting damage to the employer's brand. The policy sets out consequences for reputational harm and makes clear that the employer does not endorse the employee's personal social media views.

A Social Media Policy is required as part of compliance with the Data Protection Act No. 24 of 2019. Where employees process personal data of customers, patients, students, or other data subjects as part of their work, the policy must include specific rules on social media conduct that could involve such data — for example, prohibiting the photographing of patients in a hospital setting or the sharing of client names in a professional services context.

A Social Media Policy is needed by public benefit organisations (PBOs) registered under the Public Benefit Organisations Act No. 18 of 2013, government contractors, and regulated entities such as banks supervised by the Central Bank of Kenya and insurance companies supervised by the Insurance Regulatory Authority (IRA), all of which face enhanced regulatory scrutiny of their communications including social media output.

A Kenya Social Media Policy under the Computer Misuse and Cybercrimes Act No. 5 of 2018 and the Data Protection Act No. 24 of 2019 must contain the following elements to be legally effective and practically enforceable.

Scope and Application: A clear statement that the policy applies to all employees, directors, contractors, interns, and agents of the organisation — on all devices (personal and employer-provided) — where social media use relates to the organisation, its clients, competitors, or colleagues, or where the employee identifies themselves as being associated with the organisation. The policy must also state that it applies outside working hours when the conduct has a sufficient connection to the employment relationship.

Permitted and Prohibited Conduct: An explicit list of prohibited activities, including: disclosing confidential business information, trade secrets, or client data without authorisation (breach of Section 44 of the Employment Act and potential criminal liability under Section 16 of the Computer Misuse and Cybercrimes Act No. 5 of 2018); posting false or misleading information about the organisation, its products, or competitors (Section 22, CMCA); engaging in harassment or cyberstalking of colleagues or clients (Sections 23 and 24, CMCA); posting content that constitutes ethnic or religious hate speech contrary to the National Cohesion and Integration Act No. 12 of 2008; sharing photographs or personal data of colleagues, clients, or third parties without their consent (Data Protection Act No. 24 of 2019, s.47); and accessing the organisation's social media accounts without authorisation.

Personal Social Media Use: A statement on whether personal social media use is permitted during working hours and on work devices, and any restrictions that apply — for example, a prohibition on accessing personal social media accounts on corporate network connections during business hours.

Official Social Media Accounts: The procedure for creating, managing, and posting on official organisational accounts, including who is authorised to post on behalf of the organisation, the approval process for content, and the brand guidelines that apply. Account credentials must be managed through a password management policy, and access must be revoked immediately upon an employee's departure under the organisation's offboarding procedure.

Data Protection Compliance: Rules on handling personal data encountered on social media in accordance with the Data Protection Act No. 24 of 2019 and the Data Protection (General) Regulations 2021 published by the Office of the Data Protection Commissioner (ODPC). Employees must not share, download, or repurpose personal data of clients, colleagues, or other individuals encountered through social media without a lawful basis under Section 30 of the DPA.

Disciplinary Consequences: A clear statement that violations of the policy constitute misconduct or gross misconduct under Section 44 of the Employment Act No. 11 of 2007, with a range of sanctions from a formal written warning to summary dismissal depending on the severity of the breach. All disciplinary proceedings must comply with the fair hearing requirement of Section 41 of the Employment Act.

Reporting Obligations: A procedure for employees to report suspected policy violations, cybercrime incidents, or data breaches — including reporting to the National Computer and Cybercrimes Coordination Committee (NC4) as required under Section 36 of the Computer Misuse and Cybercrimes Act No. 5 of 2018, and to the Office of the Data Protection Commissioner (ODPC) within 72 hours of a personal data breach under Regulation 12 of the Data Protection (General) Regulations 2021.

Policy Review: A statement that the policy will be reviewed at least annually and updated to reflect changes in the law, social media platforms, and organisational needs. The forms-legal.com Kenya Social Media Policy template covers all mandatory elements required under the Computer Misuse and Cybercrimes Act No. 5 of 2018, the Data Protection Act No. 24 of 2019, and the Employment Act No. 11 of 2007.