Internet Service Provider Agreement

An Internet Service Provider Agreement in Kenya sets out the rights, duties and consideration binding the parties to it.

Under the Kenya Information and Communications Act Cap. 411A, no person may provide internet services in Kenya without a valid licence issued by the Communications Authority. Licensed ISPs in Kenya include major operators such as Safaricom, Airtel Kenya, Liquid Telecom, Jamii Telecommunications (Faiba), and numerous smaller regional providers. Each ISP must operate under CA-prescribed terms and conditions, including minimum service quality benchmarks, transparent billing practices, and data protection obligations.

The ISP Service Agreement defines the service package subscribed to — including connection type (fibre, wireless, satellite, 4G/5G mobile broadband), bandwidth allocation, upload and download speeds, contention ratios, and any fair usage policies. It also addresses the subscriber's rights regarding service interruptions, compensation for extended outages, and the process for escalating complaints to the CA.

Kenya's Data Protection Act No. 24 of 2019 imposes significant obligations on ISPs as data controllers and processors. ISPs collect and process substantial personal data including browsing patterns, device identifiers, location data, and payment information. The ISP Service Agreement must therefore contain a compliant privacy notice and data processing terms that align with the requirements of the Data Protection Act and the Data Protection (General) Regulations, 2021 administered by the Office of the Data Protection Commissioner (ODPC).

The agreement also addresses network security obligations, acceptable use policies, intellectual property rights, content filtering requirements mandated by the CA, and procedures for government-ordered network disruptions or content blocking under Section 88 of the Kenya Information and Communications Act Cap. 411A. A well-structured ISP Service Agreement protects both the provider's commercial interests and the subscriber's rights to reliable, affordable internet connectivity in Kenya's fast-growing digital economy.

The Kenya Information and Communications (Amendment) Act of 2013 introduced significant consumer protection provisions requiring ISPs to publish standard terms and conditions, provide itemised billing, and maintain complaints handling procedures accessible to subscribers. The Communications Authority Quality of Service Framework for internet services sets minimum benchmarks for latency, packet loss, jitter, and network availability that ISPs must measure, report, and maintain. Subscribers relying on internet services for business-critical operations such as e-commerce platforms, fintech services, remote work infrastructure, and video conferencing benefit from ISP agreements that specify measurable performance metrics rather than vague best-effort commitments.

The Computer Misuse and Cybercrimes Act No. 5 of 2018 imposes obligations on ISPs to cooperate with law enforcement in investigating cybercrime circulated over their networks. ISP agreements must acknowledge the lawful interception provisions of the Kenya Information and Communications Act Cap. 411A, which require ISPs to provide lawful interception capabilities to the National Intelligence Service (NIS) and other authorised agencies. The National Cohesion and Integration Act No. 12 of 2008 also requires ISPs to cooperate with content takedown orders for hate speech and incitement. Subscribers should understand that internet usage data may be disclosed to authorities pursuant to lawful court orders or regulatory directions issued by the Director-General of the Communications Authority under Section 84 of Cap. 411A.

The Universal Service Fund (USF) administered by the Communications Authority of Kenya under the Kenya Information and Communications Act Cap. 411A funds internet connectivity infrastructure in underserved areas including rural counties, remote schools, and public health facilities. ISPs receiving USF subsidies to serve these areas are subject to additional service quality obligations and reporting requirements specified in their USF programme agreements. Subscribers in USF-served areas should understand that their ISP service agreements may incorporate USF programme conditions including minimum service hours, technology standards, and community usage commitments. The Kenya National Broadband Strategy 2018-2023 set targets for achieving universal broadband access and influenced regulatory requirements that ISPs must incorporate into their standard service agreements, including transparency obligations about network management practices and data usage policies.

An Internet Service Provider Agreement in Kenya is required whenever a licensed ISP provides internet connectivity services to a subscriber. The Communications Authority of Kenya mandates that all service agreements between licensed operators and subscribers be in writing and comply with CA consumer protection regulations under the Kenya Information and Communications Act Cap. 411A.

Individual residential subscribers signing up for home fibre or broadband services from providers such as Safaricom Home Fibre, Jamii Telecom Faiba, or Zuku require a formal service agreement that defines their subscription tier, billing terms, and service level expectations. Without a written agreement, subscribers have limited recourse when services fall below advertised standards.

Corporate subscribers — including businesses, NGOs, government agencies, and educational institutions — connecting offices, campuses, or data centres to internet infrastructure need thorough ISP agreements that address dedicated bandwidth, uptime guarantees, service level agreements (SLAs), support response times, and escalation procedures. The Kenya ICT Authority recommends that government institutions entering ICT procurement agreements comply with the ICT sector standards under the Kenya Information and Communications (Consumer Protection) Regulations, 2010.

Internet service resellers and wholesale bandwidth customers — such as smaller ISPs purchasing transit bandwidth from major providers — require detailed wholesale ISP agreements addressing peering arrangements, network interconnection terms, and traffic management policies governed by the Communications Authority's Interconnection Guidelines.

Hotspot and shared internet service providers — businesses offering Wi-Fi to customers such as hotels, shopping malls, hospitals, and co-working spaces — need ISP agreements that address liability for subscriber activities, compliance with the Computer Misuse and Cybercrimes Act No. 5 of 2018, and data retention obligations under the Kenya Information and Communications (Subscriber Registration) Regulations.

When internet services are bundled with other telecommunications services — such as voice, IPTV, or cloud storage — a thorough ISP service agreement prevents disputes about billing, service degradation, and termination rights.

Startup companies and technology businesses registering with the Kenya ICT Board and the Konza Technopolis Development Authority (KoTDA) frequently need formal ISP agreements to demonstrate reliable connectivity infrastructure to investors, accelerators, and business partners. The Kenya National ICT Policy of 2019 emphasises universal access to affordable high-speed internet as a national development priority, and formal service agreements are the primary mechanism through which subscribers can hold ISPs accountable for delivering on this policy objective. Educational institutions seeking to comply with the Kenya Institute of Curriculum Development (KICD) digital learning requirements and the Kenya National Examinations Council (KNEC) online examination platform requirements also need reliable internet services formally documented through ISP service agreements specifying minimum bandwidth and uptime guarantees.

Media companies, broadcasters, and content distribution platforms operating under licences from the Communications Authority of Kenya require dedicated high-bandwidth internet connections with specific quality parameters documented in ISP agreements. Film producers, streaming platforms, and gaming companies distributing content to Kenyan audiences need ISP agreements that address peering arrangements, content delivery network (CDN) integration, and traffic prioritisation consistent with CA net neutrality guidelines. Financial technology companies operating payment processing, mobile money platforms, and digital lending services under Central Bank of Kenya oversight require internet connectivity agreements with very high uptime guarantees and security specifications that align with CBK cybersecurity guidelines for payment system operators.

Under the Companies Act No. 17 of 2015, the Registrar of Companies at the Office of the Attorney General maintains the register of Kenyan companies. Section 3 of the Law of Contract Act (Cap. 23) governs contractual obligations. The Competition Authority of Kenya (CAK) enforces the Competition Act No. 12 of 2010. The Kenya Revenue Authority (KRA) administers corporate tax under the Income Tax Act (Cap. 470). The High Court of Kenya has unlimited original jurisdiction under Article 165 of the Constitution of Kenya 2010.

A thorough Internet Service Provider Agreement in Kenya under the Kenya Information and Communications Act Cap. 411A must address numerous critical provisions to protect both the ISP and the subscriber. The agreement should begin by identifying both parties clearly, referencing the ISP's Communications Authority of Kenya licence number and the subscriber's national ID or company registration details.

**Service Description and Specifications.** The agreement must precisely describe the internet service being provided — including connection technology (fibre optic, wireless, satellite, 4G/5G), committed information rate (CIR) or best-effort bandwidth, contention ratio, IP address allocation (static or dynamic), and any value-added services such as email hosting, cybersecurity features, or cloud storage. The CA's Quality of Service Framework requires minimum performance standards that must be referenced.

**Service Level Agreement (SLA).** For business-grade connections, the SLA must specify guaranteed uptime percentage (typically 99.5% or higher), maximum permissible downtime per month, response time for fault reporting, resolution time for service restoration, and compensation mechanisms for SLA breaches. The Communications Authority's Quality of Service Regulations provide benchmarks for minimum acceptable service levels.

**Acceptable Use Policy (AUP).** The agreement must incorporate an AUP that prohibits illegal activities including distribution of child sexual abuse material (prohibited under the Sexual Offences Act No. 3 of 2006), cybercrime activities (prohibited under the Computer Misuse and Cybercrimes Act No. 5 of 2018), and transmission of content blocked by CA regulatory order under Section 88 of the Kenya Information and Communications Act Cap. 411A.

**Data Protection and Privacy.** Under the Data Protection Act No. 24 of 2019, the ISP must disclose its role as a data controller, the categories of personal data collected, the legal basis for processing, data retention periods, and subscriber rights including access, rectification, and erasure. The agreement must reference the ISP's privacy policy registered with the Office of the Data Protection Commissioner (ODPC).

**Billing and Payment Terms.** The agreement must specify subscription fees, billing cycle, payment methods accepted (including M-PESA, bank transfer, and credit card), late payment penalties, and the process for service suspension upon non-payment. The CA's Consumer Protection Regulations require advance notice before service disconnection.

**Equipment and Infrastructure.** Where the ISP provides customer premises equipment (CPE) such as routers, ONTs, or antennas, the agreement must specify ownership, maintenance responsibility, return obligations upon termination, and liability for damage. Installation terms, right-of-way access for cable laying, and compliance with the Kenya Communications (Installation of Cables) Regulations must be addressed.

**Termination and Dispute Resolution.** The agreement must state notice periods for termination, early termination fees if applicable, procedures for porting or transferring services, and the subscriber's right to escalate complaints to the Communications Authority of Kenya's consumer affairs division under the Kenya Information and Communications (Consumer Protection) Regulations, 2010.

Forms-legal.com provides this template as a starting framework; subscribers and ISPs should confirm CA licence conditions and sector-specific regulations are reflected before execution.

**Network Redundancy and Failover.** For business-critical internet connections, the agreement should specify whether the ISP offers network redundancy such as dual-path routing, automatic failover, or backup connectivity via a secondary technology such as 4G LTE backup for a primary fibre connection. Failover capability and the time required to switch to backup connectivity should be documented in the SLA. The Communications Authority Guidelines on Network Resilience provide frameworks for ISP redundancy standards applicable in Kenya.

**Regulatory Change Provisions.** The Kenya Information and Communications Act Cap. 411A and CA regulations are subject to periodic amendment. The agreement should include a regulatory change clause that permits either party to modify or terminate the agreement without penalty if a change in applicable law makes performance impractical or significantly alters the commercial basis of the arrangement. CA licence conditions may be varied by the regulator, and variations may require corresponding adjustments to service terms communicated to subscribers with at least 30 days advance notice.

**Security Incident Response.** The agreement should specify the ISP obligations upon detecting a cybersecurity incident affecting the subscriber connection including notification timelines, evidence preservation, cooperation with forensic investigation, and the procedure for isolating compromised connections under the Computer Misuse and Cybercrimes Act No. 5 of 2018.

The agreement must also address **IPv6 transition** obligations. The Communications Authority of Kenya has directed ISPs to implement IPv6 as part of the national internet infrastructure modernisation programme, given the exhaustion of IPv4 address space. Subscribers with large device estates or IoT deployments need ISP agreements that specify whether IPv6 addresses are provided, whether dual-stack operation is supported, and the timeline for full IPv6 enablement. Businesses running cloud infrastructure or hosting services should confirm IPv6 support before signing long-term ISP contracts. The agreement should further specify **support channels** available to the subscriber including a dedicated account manager for business customers, 24-hour technical support hotline numbers, an online fault reporting portal, and escalation contacts at senior management level for critical incidents unresolved within the SLA response window.

Under the Companies Act No. 17 of 2015, the Registrar of Companies at the Office of the Attorney General maintains the register of Kenyan companies. Section 3 of the Law of Contract Act (Cap. 23) governs contractual obligations. The Competition Authority of Kenya (CAK) enforces the Competition Act No. 12 of 2010. The Kenya Revenue Authority (KRA) administers corporate tax under the Income Tax Act (Cap. 470). The High Court of Kenya has unlimited original jurisdiction under Article 165 of the Constitution of Kenya 2010.