Kenya Mandates Customer Registration and Data Retention for Cyber Cafés Under New Regulatory Framework
Nairobi, Kenya – Cyber cafés and other public communication access centres in Kenya are now subject to stringent new regulations requiring mandatory customer registration and the retention of user logs for a minimum of three years. Issued by the Communications Authority of Kenya (CA), these new licensing conditions, effective August 14, 2026, aim to bolster efforts against cybercrime by providing authorities with essential data for inspections, audits, and investigations.
The updated rules mandate that operators establish a robust system for registering customers, meticulously recording terminal identification, and logging session start and end times. Crucially, while user session data must be preserved, operators are explicitly prohibited from collecting or storing customers’ personal browsing history. All such records must be maintained for at least three years from their creation date and made available to the Authority upon request. Authorised officers of the CA will be granted reasonable access to premises, systems, records, and equipment for compliance verification.
These measures are designed to address the exploitation of public internet facilities by criminals who have historically operated with minimal user identification. The CA highlighted that unsecured public cyber cafés can also become vectors for cyber threats, with criminals potentially installing malware to steal sensitive information or intercept network traffic. Beyond data retention, the new framework compels operators to clearly display service charges, issue receipts, and implement systems for handling customer complaints and feedback.
Further enhancing online safety, cyber cafés must now deploy content-filtering systems to shield users from harmful or illegal material and adhere to the Authority’s online safety guidelines. The use of approved electronic communications equipment is also mandated, alongside the requirement to obtain internet connectivity from licensed Internet Service Providers holding an Application Service Provider license. The CA has also directed the installation of software and network filters to block illegal websites and conduct real-time scanning of web traffic to prevent dangerous downloads.
The regulatory overhaul also addresses service delivery standards, requiring operators to ensure reliable, accessible, and consistent services, with prompt resolution of interruptions and outages. Accessibility for people with disabilities is also a key consideration. Businesses found in breach of these new regulations face severe penalties, including fines equivalent to 0.2% of their annual turnover, with a minimum penalty of Sh500,000, and potential suspension or closure of operations. Notably, a previously proposed requirement for mandatory CCTV surveillance has been omitted from the final licensing conditions.
