Software Development Agreement (Kenya)

A Software Development Agreement in Kenya is a legally binding contract under the Law of Contract Act Cap. 23 in which a client commissions a developer or development company to design, build, test, and deliver bespoke software — including web applications, mobile applications, enterprise management systems, and custom platforms — in exchange for an agreed fee and on terms governing intellectual property ownership, delivery milestones, warranties, and confidentiality.

The Kenya Software Development Agreement sits at the intersection of contract law, intellectual property law, and data protection law. The Law of Contract Act Cap. 23 applies the principles of the English common law of contract as received into Kenyan law, requiring offer, acceptance, consideration, capacity, and intention to create legal relations for a valid and enforceable agreement under the Act's general provisions.

The Copyright Act Cap. 130 (updated by the Copyright (Amendment) Act 2019), administered by the Kenya Copyright Board (KECOBO), is the principal intellectual property statute relevant to software in Kenya. Section 22A of the Copyright Act Cap. 130 expressly protects computer programs as literary works, regardless of whether the program is expressed in source code, object code, or any other form. Under Section 30 of the Copyright Act, where a work is created by an employee in the course of employment, the copyright vests in the employer. Where a work is created by an independent contractor, copyright vests in the contractor unless the parties contractually agree otherwise. A well-drafted Software Development Agreement must therefore include an explicit intellectual property assignment clause transferring ownership of the bespoke software from the developer to the client upon full payment of the development fee.

The Data Protection Act No. 24 of 2019 (DPA), administered by the Office of the Data Protection Commissioner (ODPC), is critically relevant where the software to be developed will process personal data of Kenyan residents — for example, a customer management system, a health records platform, or an e-commerce application. The DPA requires data controllers to confirm that their data processors — including software developers who access personal data during development and testing — are bound by a Data Processing Agreement under Section 47 of the DPA. The Software Development Agreement should therefore incorporate or reference a Data Processing Agreement where applicable.

The Kenya Information and Communications Act Cap. 411A, administered by the Communications Authority of Kenya (CA), governs electronic transactions and digital services in Kenya. The Kenya Information and Communications (Electronic Transactions) Regulations 2010 recognise the validity of electronic contracts and electronic signatures, enabling Software Development Agreements and acceptance of deliverables to be executed electronically.

The Computer Misuse and Cybercrimes Act No. 5 of 2018 (CMCA) is relevant to Software Development Agreements in two ways: first, it creates criminal liability for a developer who maliciously inserts malicious code, backdoors, or logic bombs into delivered software under Section 16 of the CMCA (unauthorised interference with computer systems); second, it creates obligations on the client to protect any software access credentials provided to the developer during the engagement under Section 33 of the CMCA.

The Income Tax Act Cap. 470 administered by the Kenya Revenue Authority (KRA) requires that payments to non-resident software developers be subject to withholding tax under Section 35 of the Act — currently at 20% on royalties and 5% on service fees for non-residents. The agreement should specify which party bears the withholding tax obligation and how the net payment is calculated.

A Software Development Agreement in Kenya is required in every commercial engagement where a client is paying for bespoke software development and wants clear rights over the delivered product, certainty on delivery timelines, and protection against developer insolvency, abandonment, or intellectual property disputes.

The agreement is needed when a Kenyan startup commissions a development agency or freelance developer to build a minimum viable product (MVP). Without a written agreement, the startup has no legal claim to the source code — the developer retains copyright under Section 30 of the Copyright Act Cap. 130 — and the startup may be unable to obtain investor funding or transfer the technology to a new developer if the relationship breaks down.

The agreement is required when a Kenyan financial institution — a bank supervised by the Central Bank of Kenya (CBK), a microfinance institution, or a SACCO regulated by SASRA — commissions custom financial software. Financial institutions are subject to regulatory requirements on technology governance and must be able to demonstrate to CBK examiners that they own the source code of critical systems and hold escrow copies against developer insolvency, as required by the CBK Guidance on Outsourcing of Functions by Institutions.

The agreement is needed when a healthcare provider — a hospital, clinic, or telemedicine platform — commissions a health records management system or patient portal. The software will process sensitive health data under the Data Protection Act No. 24 of 2019, and the agreement must address data processing obligations, security standards (encryption, access controls), and the developer's data breach notification obligations under Regulation 12 of the Data Protection (General) Regulations 2021.

The agreement is required when a county government or national government agency commissions custom software under a public procurement contract. The Public Procurement and Asset Disposal Act No. 33 of 2015 requires written contracts for government procurement, and the Software Development Agreement must comply with the standard terms for ICT contracts published by the Public Procurement Regulatory Authority (PPRA).

The agreement is needed when a Kenyan business engages an offshore development team — based in India, Ukraine, Eastern Europe, or elsewhere — to build software for the Kenyan market. The agreement must specify governing law (Kenya), the dispute resolution forum, withholding tax obligations under Section 35 of the Income Tax Act Cap. 470, and the intellectual property assignment mechanism to confirm that ownership vests in the Kenyan client company upon payment.

A Kenya Software Development Agreement under the Law of Contract Act Cap. 23 and the Copyright Act Cap. 130 must contain the following essential elements to be enforceable and to protect both client and developer.

Parties and Recitals: Full legal names, addresses, and registration numbers of the client and the developer. For corporate parties, the Business Registration Service (BRS) number from eCitizen. The recitals should briefly describe the background to the engagement and the nature of the software to be developed.

Scope of Work and Specifications: A detailed technical specification or functional requirements document (FRD), attached as a schedule to the agreement, describing precisely what software the developer will build — features, platforms (web, iOS, Android), integrations with third-party services, performance requirements, and user volumes. Ambiguity in the scope is the most common source of Kenya software development disputes before the Employment and Labour Relations Court and the Nairobi Centre for International Arbitration (NCIA).

Delivery Milestones and Acceptance: A project plan specifying key milestones — wireframes, prototype, beta version, user acceptance testing (UAT), go-live — each with a delivery date and acceptance criteria. The client must have a defined period (typically 7–14 days) to review each deliverable and either accept it in writing or provide written objections. Acceptance of a milestone triggers the milestone payment under the payment schedule.

Payment Terms: The total contract price in Kenya Shillings (KES), the payment schedule tied to milestone acceptance, the method of payment (bank transfer, M-Pesa, or other), and the consequences of late payment — typically interest at the agreed rate or at the court rate under the Law of Contract Act Cap. 23. Withholding tax obligations under the Income Tax Act Cap. 470 must be addressed where the developer is a non-resident or where the payment is a royalty.

Intellectual Property Assignment: An explicit clause under the Copyright Act Cap. 130 assigning all intellectual property rights in the bespoke software — including copyright, any patent rights, trade secrets, and database rights — from the developer to the client, effective upon full payment of the development fee. The agreement must separately address ownership of: pre-existing developer tools and libraries incorporated into the software (typically licensed, not assigned); open-source components (governed by the relevant open-source licence — GPL, MIT, Apache); and improvements made by the developer to pre-existing tools.

Source Code Escrow: Where the client depends critically on the software, a source code escrow arrangement with a Kenya-based escrow agent releases the source code to the client if the developer becomes insolvent, ceases to maintain the software, or commits a material breach — protecting the client from being locked out of their own system.

Confidentiality and Data Protection: Mutual obligations to keep the other party's confidential information secret, and specific developer obligations to comply with the Data Protection Act No. 24 of 2019 and the Data Protection (General) Regulations 2021 where personal data is processed during development or testing. The developer must implement appropriate technical and organisational security measures under Section 41 of the DPA.

Warranties and Defect Liability: The developer's warranties that the software will perform in accordance with the specifications, be free from material bugs for a defined warranty period (typically 3–12 months post-delivery), not infringe third-party intellectual property rights, and not contain malicious code contrary to Section 16 of the Computer Misuse and Cybercrimes Act No. 5 of 2018. The defect liability period defines the developer's obligation to fix bugs reported after go-live at no additional cost.

Dispute Resolution: The governing law is the laws of Kenya. Disputes may be referred to arbitration before the Nairobi Centre for International Arbitration (NCIA) under the Arbitration Act No. 4 of 1995, or to litigation before the High Court of Kenya under the Civil Procedure Act Cap. 21. The forms-legal.com Kenya Software Development Agreement template covers all mandatory elements under the Law of Contract Act Cap. 23 and the Copyright Act Cap. 130.