Computer Misuse and Cybercrimes Amendment Act 2025: What Changed and What It Means for Victims
In October 2025, Kenya’s cyber harassment laws changed dramatically — and then, a week later, partly changed back. If you are dealing with online harassment, cyberbullying, or defamation in Kenya, the current legal situation is genuinely confusing, even to lawyers. This guide explains exactly what the Computer Misuse and Cybercrimes (Amendment) Act 2025 says, what the High Court has suspended, what remains in force, and — most importantly — what this means practically if you are a victim trying to get justice.
Quick answer: The Computer Misuse and Cybercrimes (Amendment) Act, 2025 was signed into law by President William Ruto on 15 October 2025, expanding the offence of cyber harassment under Section 27 to cover content that “detrimentally affects” a person, is “indecent or grossly offensive,” or is likely to cause someone to attempt suicide — with penalties of up to KES 20 million or 10 years imprisonment. Seven days later, on 22 October 2025, the High Court suspended Sections 27(1)(b), (c) and (2) pending a constitutional challenge brought by the Kenya Human Rights Commission and activist Reuben Kigame. Those provisions remain unenforceable. Critically, none of this affects your right to bring a civil defamation claim — the civil route under the Defamation Act (Cap. 36), covered in our step-by-step guide to suing for online defamation in Kenya, operates independently of the criminal cybercrime framework and is unaffected by this dispute.
Background: Why the Law Changed
The Computer Misuse and Cybercrimes Act was originally enacted in 2018 to address cyber fraud, identity theft, data breaches, and unauthorised access to computer systems. Section 27 of the original Act already criminalised “cyber harassment” — but as cyberbullying, online abuse, and coordinated harassment campaigns grew more sophisticated across Facebook, X (Twitter), TikTok, and WhatsApp, lawmakers argued the existing provisions were too narrow to address the scale of the problem.
A draft amendment bill was published by Parliament in August 2024. After an extended period of public participation and committee review, the Computer Misuse and Cybercrimes (Amendment) Act was passed by Parliament and assented to by President Ruto on 15 October 2025.
What the 2025 Amendment Changed
The amendment introduced several changes across the Act, but three are most relevant to anyone dealing with online harassment.
1. Section 27 — Cyber Harassment, Expanded
The amended Section 27 broadened the definition of cyber harassment to cover electronic communication that:
- “Detrimentally affects” a person
- Is of an “indecent or grossly offensive” nature
- Results in, or is likely to cause, a person to attempt or commit suicide
The penalty for cyber harassment under Section 27 remains severe: a fine of up to KES 20 million, imprisonment for up to 10 years, or both.
2. Expanded Powers Over Websites and Applications
The amendment broadened the mandate of the National Computer and Cybercrimes Coordination Committee, giving it authority to issue directives making websites or applications inaccessible where they are found to promote unlawful activity — including content involving the sexual exploitation of minors, or content advocating terrorism, religious extremism, or cultism. This power is subject to a requirement of proof before a directive can be issued.
3. Broader Evidence-Gathering Powers for Law Enforcement
The amendment expanded the investigative powers available to law enforcement to access and preserve electronic evidence — relevant to how cybercrime investigations (including those touching on harassment) are conducted going forward.
Why the Law Was Immediately Challenged
The expanded Section 27 provisions — particularly the “detrimentally affects” and “indecent or grossly offensive” language — drew immediate and sustained criticism from civil society organisations, including the Law Society of Kenya, the Kenya Human Rights Commission (KHRC), and digital rights groups such as ARTICLE 19 and KICTANet.
The core objection was about vagueness. Critics argued that phrases like “detrimentally affects a person” are so broad and subjective that almost any critical, satirical, or unflattering online statement about a public figure could be characterised as cyber harassment — creating a tool that could be used to silence legitimate criticism, journalism, and political commentary rather than to protect genuine victims of harassment.
Former Chief Justice David Maraga publicly criticised the amended Act, describing the new provisions as risking abuse, censorship, and political manipulation, and arguing that granting such broad executive power was less about protecting Kenyans from cyberbullying and more about controlling information and silencing dissent. President Ruto, for his part, defended the amendments as necessary to protect Kenyans from cyberbullying and other online criminal activity.
The High Court Suspension: What Actually Happened
On 22 October 2025 — exactly one week after the President assented to the Act — Justice Lawrence Mugambi of the Milimani Law Courts issued conservatory orders in response to an urgent application filed by gospel musician and activist Reuben Kigame, the Law Society of Kenya, and the Kenya Human Rights Commission.
The court suspended the enforcement, implementation, and operation of:
- Section 27(1)(b) — the “detrimentally affects a person” provision
- Section 27(1)(c) — the “indecent or grossly offensive” provision
- Section 27(2) — related provisions
This suspension is a conservatory order — a temporary measure that holds these specific provisions in legal limbo while the substantive constitutional petition is heard and determined. The petitioners argue that these provisions are unconstitutional because they introduce vague and overbroad language that criminalises legitimate online expression, and because they weaken the protections established under the Data Protection Act 2019.
As of mid-2026, the constitutional petition challenging these provisions has not yet been finally determined — meaning the suspended sections remain unenforceable, and the underlying constitutional question remains open.
What This Means in Practice
If you are dealing with online harassment, cyberbullying, or defamation in Kenya right now, here is what the current legal landscape actually means for you.
The suspended provisions cannot currently be used to prosecute someone
If the harassment you are experiencing would only fall under the suspended language — content that is merely “indecent,” “grossly offensive,” or “detrimentally affects” you, without more — a criminal prosecution under those specific clauses is not currently available, because the provisions are under conservatory suspension.
Other parts of Section 27, and other sections of the Act, remain in force
The suspension is narrow — it applies only to Section 27(1)(b), (c) and (2). Other cyber offences under the Computer Misuse and Cybercrimes Act — including identity theft (Section 26), unauthorised access offences, and the wrongful distribution of intimate images (Section 27A) — are unaffected by this suspension and remain fully enforceable.
The criminal route has become less predictable — the civil route has not
This is the most important practical point. The constitutional uncertainty around Section 27 means that the criminal route — reporting to the DCI Cybercrime Unit and hoping for a prosecution — now sits on genuinely contested legal ground for a significant category of harassment cases. A prosecution that relies on suspended provisions may stall, or may proceed on shakier footing pending the constitutional court’s final ruling.
By contrast, civil defamation claims under the Defamation Act (Cap. 36) are entirely unaffected by this dispute. The constitutional challenge to the Computer Misuse and Cybercrimes Amendment Act concerns criminal provisions — it has no bearing on your right to sue for damages where someone has published false, defamatory statements about you online. As covered in our guide on how to sue for online defamation in Kenya, the civil process — proving publication, falsity, reference to you, defamatory character, and harm — proceeds entirely independently of the criminal cybercrime framework, and Kenyan courts have continued to make substantial damages awards in such cases throughout this period of legal uncertainty.
Evidence still matters more than ever
Regardless of which route you pursue — and many victims pursue both — the practical reality has not changed: a case built on forensically preserved evidence is dramatically stronger than one built on deleted-and-forgotten screenshots. If anything, the heightened public attention on cyber harassment law in Kenya means more people are aware of their rights and more likely to act — but awareness without evidence still results in weak cases.
Has the Law Actually Been Used Against Anyone Yet?
Yes. Even in the brief period since the Act was signed, authorities have applied parts of it. Reports have documented that a blogger was charged in connection with remarks made about a former county governor and political commentator, and another individual faced cyber harassment charges related to separate conduct. These early cases illustrate exactly the concern that civil society raised — that the law’s broad language creates uncertainty about what speech is now criminal, and that determination is likely to depend heavily on the specific facts and the discretion of investigating officers and prosecutors, at least until the constitutional petition is resolved.
For someone who is the victim of harassment, this uncertainty cuts both ways — it may mean a criminal complaint about genuinely abusive conduct is taken seriously and acted upon quickly, but it also means the outcome of any prosecution is less predictable than it would be under settled law. This is precisely why building a strong civil case — which does not depend on the outcome of the constitutional petition — remains the most reliable path to a remedy.
What Should You Do If You’re Being Harassed Online Right Now?
The legal uncertainty around Section 27 does not change the practical first steps for anyone experiencing online harassment, cyberbullying, or defamation in Kenya:
1. Do not engage or confront the person publicly. This remains true regardless of which legal route you pursue.
2. Preserve the evidence immediately — forensically, not just with screenshots. Content gets deleted, accounts get deactivated, and the window to capture evidence in a form that will hold up in either a civil or criminal proceeding is short. This step matters under both the civil and criminal frameworks, and is unaffected by the constitutional dispute.
3. Consider both routes — but don’t make your civil claim dependent on the criminal one. You can file an OB number with the police or report to the DCI Cybercrime Unit while simultaneously pursuing a civil defamation claim. The civil claim does not need to wait for, or depend on, any outcome of a criminal investigation or prosecution.
4. Speak to an advocate about which sections of the Act, if any, apply to your situation. Given the suspension affects only specific subsections, whether your situation falls within the suspended provisions, the unaffected provisions, or purely civil territory is a fact-specific question worth a proper legal opinion.
5. Get the evidence question right from the start. Whether your matter proceeds as a civil claim, a criminal report, or both, the evidence-gathering exercise is largely the same — and is far more effective when done by a forensic investigator within the first 24–48 hours, before content disappears.
How Ultimate Forensic Consultants Can Help
Whatever happens with the constitutional petition, our position is unchanged: the civil route is the most reliable, victim-controlled path to a remedy for online harassment and defamation in Kenya, and it depends entirely on the quality of your evidence.
Ultimate Forensic Consultants is a PSRA-licensed, ODPC-registered forensic investigation firm based in Westlands, Nairobi, with a 99% High Court report acceptance rate across 57+ matters. Our cyberbullying and online defamation investigation service preserves digital evidence within 24–48 hours, identifies anonymous perpetrators through OSINT and metadata analysis, and produces a court-ready forensic report — built to support a civil claim regardless of how the criminal law landscape develops.
If you are dealing with online harassment in Kenya, read our guides on how to sue for online defamation and how much compensation you can claim, then contact us for a free, confidential assessment — WhatsApp +254 100 177 094. We work alongside your advocate to make sure your case is built on the strongest possible footing, whichever legal route you ultimately pursue.
Frequently Asked Questions
Is cyberbullying still illegal in Kenya after the High Court suspension?
Yes, in large part. The High Court suspended only specific subsections — Section 27(1)(b), (c) and (2) — covering content that is “detrimentally affecting,” “indecent or grossly offensive,” or likely to cause suicide. Other cyber harassment provisions, identity theft offences under Section 26, and the wrongful distribution of intimate images under Section 27A remain fully in force. Civil defamation claims under the Defamation Act are entirely unaffected.
Can I still report cyberbullying to the police in Kenya right now?
Yes. You can still file a report with the police or the DCI Cybercrime Unit. Whether the specific conduct you experienced falls within a suspended provision, an unaffected provision, or is better addressed through a civil claim depends on the facts of your case — a consultation with an advocate can clarify this. Reporting to the police does not prevent you from also pursuing a civil claim.
Does the suspension of Section 27 affect my ability to sue for online defamation?
No. The constitutional challenge concerns criminal provisions of the Computer Misuse and Cybercrimes Act. Civil defamation claims are brought under the Defamation Act (Cap. 36) and common law, which operate entirely separately from the cybercrime framework. Your right to sue for damages for false, defamatory statements published about you online is unaffected by this dispute.
When will the constitutional petition be decided?
As of mid-2026, the constitutional petition challenging the suspended provisions had not yet been finally determined. Constitutional petitions of this nature in Kenya can take a significant period to resolve. Until a final determination is made, the conservatory suspension of Section 27(1)(b), (c) and (2) remains in effect.
Should I wait for the constitutional petition to be resolved before taking action against someone harassing me online?
No. If you are being harassed or defamed online now, the most time-sensitive action — preserving evidence before it is deleted — should happen immediately, regardless of the constitutional petition’s outcome. A civil defamation claim can proceed entirely independently of that petition, and evidence preserved now remains valuable whether your matter ultimately proceeds as a civil claim, a criminal report, or both.
This article provides general information about the legal and regulatory landscape in Kenya as of mid-2026 and does not constitute legal advice. The status of the constitutional petition referenced in this article may change. Consult a qualified Kenyan advocate for advice specific to your situation. If dealing with online harassment has affected your wellbeing, support is available, and Ultimate Forensic Consultants can help connect you with appropriate resources alongside the legal process.