The International Press Institute, together with Article 19 Eastern Africa, the Association of Progressive Communications and Pollicy submitted comments to Kenya’s draft Cybersecurity Strategy, 2025 -2029.
Anchored on nine strategic pillars, the draft strategy aims to ‘to align with the Government’s digital transformation agenda, ensure a harmonized approach to cyber incident response and management, incorporate artificial intelligence and other emerging technologies as well incorporate the provisions of the Computer Misuse and Cybercrime (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024.
As noted in our comments, we commend the government’s affirmation to uphold constitutional rights, in particular, by safeguarding the rights to privacy, freedom of expression, and access to information, as guaranteed under the Constitution of Kenya. However, given the potential impact that cybersecurity policies can have on human rights, we strongly recommend strengthening the human rights framing and safeguards throughout the strategy, together with adopting a risk-based approach.
Strengthening human rights safeguards and approaches are not only important in developing and refining Kenya’s cybersecurity policy and legal framework, but also in executing the nine strategic focus areas: cybersecurity policies, laws, regulations and standards; cybersecurity governance; critical information infrastructure protection; cybersecurity capability and capacity building; cyber risks and cybercrimes management; cyber incident response and management; new and emerging technologies; public private partnership; and international cooperation and collaboration.
The strategy is notably silent on the intersectionality of gender and cybersecurity. We emphasise the need to mainstream gender in the strategy in a gender responsive manner.
Other recommendations are on access to data, definitional clarity, enhanced inclusive and meaningful participation of key stakeholders, including civil society, and the inclusion of budget allocations.