Kenya’s non-profit organisations handle some of the country’s most sensitive personal information, including beneficiary records, health data, case files, and donor details, often without a clear path to legal compliance. This manual provides non-profit organisations in Kenya with a practical framework to bridge the gap between legal theory under the Data Protection Act, 2019 and real-world application. Developed out of a recognition that data protection is directly tied to the dignity, safety, autonomy, and trust of the communities served, this publication translates complex privacy laws into operational steps for non-profit staff.

As Kenya’s media and information landscape becomes increasingly digital, the intersection between data protection, media practice, and elections is becoming more important than ever. Journalists, media houses, regulators, civil society organizations, and digital platforms all play a critical role in shaping electoral discourse and safeguarding democratic participation.

Kenya’s Sexual Offences Act was passed in 2006, when smartphones were not yet in most Kenyan pockets, and generative AI did not exist. Twenty years on, the Sexual Offences (Amendment) Bill, 2026 proposes to bring the Act up to date with how technology is increasingly used to facilitate sexual and gender-based violence: through a phone, an account, a group chat, or even an image that was never real. 

A voice is a fragile thing in the digital age. It can rise in seconds, clear, bold, and determined, and be drowned out just as quickly by waves of insult, distortion, and threat. For many young Kenyans, this is not a distant reality; it is a daily calculation. Should I post this? Is it worth the backlash? Will I still feel safe tomorrow? These are the silent questions behind many unsent messages.  

In a digital environment where online harassment and tech-facilitated violence are used to silence voices, how can Kenya protect itself, support young people in others, and still find the courage to speak out for their rights and the rights of others?  

Post about a breaking news event, share an unverified allegation, or even repeat a rumor in a WhatsApp group, and until this year you could, in theory, have faced up to ten years in prison. That was the potential consequence of Sections 22 and 23 of the Computer Misuse and Cybercrimes Act, which criminalized the publication of “false” information using broad and vaguely defined offences. The provisions cast a long shadow over anyone with access to a phone or the internet. On 6 March, however, the Court of Appeal struck them down. In a case brought by the Bloggers Association of Kenya, International Commission of Jurists (ICJ) Kenya, Article 19 and others, the court called them so broad they were “like unguided missiles.” 

The Human Rights Digest is Amnesty International Kenya’s regular roundup of the latest human rights developments, analysis, campaigns, and actions from Kenya and beyond.

In December 2025, Australia became the first country in the world to bar anyone under 16 from holding a social media account. Within a day, its own prime minister was dealing with the predictable result. Teenagers flooded the comment section on Anthony Albanese’s TikTok account, including one that read, “I’m still here, wait until I can vote.” A 14-year-old, in New South Wales, had already told the Washington Post weeks earlier that she planned to log back into Snapchat and Instagram using her mother’s Face ID. On Reddit, teenagers traded tips on beating facial age checks, including printing a mesh face mask bought from Temu. The free VPN app Windscribe reported a 400 percent jump in Australian downloads in the first 24 hours after the law took effect. Leonardo Puglisi, the teenage founder of the youth outlet 6 News Australia, said his platform barely felt the impact at all.

This year, we asked a hard question. Under the theme Voices Online: Courage, Silence and Harassment, we invited students across Kenya to sit with a reality many young people already know; that speaking out online can carry a cost: Threats, ridicule, coordinated attacks and silence chosen not out of indifference, but out of fear. 

On the night of May 27, 2026, a dormitory at Utumishi Girls Academy in Gilgil caught fire. Sixteen students died and 79 others were injured when a fire tore through the Meline Waithera block, a dormitory housing approximately 220 students. In the days that followed, CCTV footage from inside the dormitory went viral, broadcast on television, shared across WhatsApp, dissected on X. The footage aired by a local TV station showed students walking through the dormitory moments before the fire broke out, revealing how persons of interest moved from cube to cube before the blaze erupted near the exit points, trapping dozens of students who were still sleeping.  Then a second conversation started- quieter, but just as uncomfortable. CCTV footage showed girls inside their dormitory. They were minors. They hadn’t consented to being filmed. They hadn’t consented to their images being broadcast on national television. And now, some of them are facing murder charges partly based on that footage.

“We are taking action by having them here in Kenya and being subjected to our laws and measures that are there to protect our children,” – ICT CS, Hon. Kabogo

A Kenyan court just changed the rules for every organization that collects personal information. Think about every organization that has your data right now: your mobile network, bank, health insurer, the security system that scanned your ID at the door, the betting app that knows your transaction history, and the government agency that issued your documents. Every one of them holds information about your location, finances, identity, and behaviour in a database you have never seen and cannot access. Until mid-May 2026, many of these organizations operated under a comfortable assumption: as long they did not intend for something to go wrong, they would not be responsible if it did.