Kenya has experienced rapid growth in technology and digital services.
However, this growth has also created new risks. As a result, experts say Kenya needs stronger measures to protect its digital space.
The country already has laws such as the Computer Misuse and Cybercrimes Act. However, stakeholders believe Kenya also needs the Malabo Convention to address cross-border digital challenges.
What is the Malabo Convention?
The Malabo Convention is an African Union treaty on cybersecurity, electronic transactions and personal data protection.
The AU adopted the agreement on June 27, 2014, during its 23rd Ordinary Session in Malabo, Equatorial Guinea.
More than 10 years later, Kenya has not yet ratified the convention.
The Cabinet approved the agreement in 2025. However, the National Assembly still needs to approve its ratification.
Experts say Malabo Convention can fill legal gaps
A policy brief commissioned by Mzalendo Trust and Oxfam Kenya has renewed calls for Kenya to ratify the agreement.
The technology sector stakeholders behind the brief say the convention could help Kenya address gaps in cybersecurity and data protection.
It could also strengthen rules governing electronic transactions.
Some experts have argued that Kenya already has stronger digital laws than the Malabo Convention.
However, the stakeholders say this view has delayed the treaty’s adoption.
They argue that Kenya can use the convention to address important gaps in its current legal framework.
These gaps include the lack of comprehensive Artificial Intelligence (AI) regulations.
They also include limited mechanisms for enforcing digital laws across borders.
In addition, stakeholders say Kenya needs stronger safeguards for individual rights.
“Ratification also grants Kenya a seat at the table to propose Convention amendments addressing these weaknesses,” the policy brief states.
Stakeholders call for faster ratification
The stakeholders have urged the Cabinet to approve the ratification process without further delays.
They also want Kenya to include an interpretative declaration.
The declaration would affirm Kenya’s sovereignty over data linked to national security.
Meanwhile, they have called on Parliament to prioritise debate on the convention.
They want the ICT Committee to lead the process.
The stakeholders also stressed the need to comply with Article 118 of the Constitution.
The article requires public participation during parliamentary processes.
Experts propose changes to data protection funding
The stakeholders have also raised concerns about funding for data governance in Kenya.
They recommend changes to the Data Protection Regulations.
The proposed changes would allow the Office of the Data Protection Commissioner (ODPC) to retain a set percentage of administrative fines and controller registration fees.
According to the stakeholders, the move would reduce the ODPC’s dependence on government funding.
As a result, the agency could gain more resources to enforce data protection laws.
The stakeholders believe stronger funding would improve Kenya’s ability to protect personal data and respond to emerging digital threats.
