- Court suspends parts of the Computer Misuse and Cybercrimes (Amendment) Act, 2024.
- Petition filed by musician Reuben Kigame and KHRC.
- Petitioners argue the law threatens data privacy and freedom of expression.
- Court orders submissions to be heard before enforcement.
- Case to return to court on November 5, 2025.
The Nairobi High Court has stopped the enforcement of key parts of the Computer Misuse and Cybercrimes (Amendment) Act, 2024. President William Ruto signed the law on October 15, 2025. The suspension will remain in place until a petition filed against the Act is heard and determined.
On Wednesday, October 22, 2025, Justice Lawrence Mugambi suspended Section 27(1)(b), Section 27(1)(c) and Section 27(2) of the Act.
“Pending the hearing and determination of this application, a conservatory order is hereby issued suspending the enforcement, implementation, and operation of Section 27(1)(b), (c), and (2),”
— Justice Lawrence Mugambi
Musician and activist Reuben Kigame and the Kenya Human Rights Commission (KHRC) filed the petition a day after the bill was signed.
They argue that the amended law violates the Constitution and conflicts with the existing Data Protection Act (DPA).
The petition states that criminalising content described as false, misleading, or mischievous is vague and could silence public opinion online.
“The Criminalisation of ‘False, Misleading, and Mischievous’ Information chills freedom of expression and lacks the precision required by law,”
— Petitioners
According to the petition, the law will require all social media users to verify their identities using government-issued IDs. Petitioners argue this could expose users’ private data and weaken digital privacy rights.
They say this creates a new, weaker system for handling user information, clashing with protections in the Data Protection Act.
Petitioners accuse lawmakers of creating overlapping procedures for data access and monitoring. They warn that this may lead to confusion and weaken Kenyans’ digital rights.
Part of the petition claims:
“The amendments are overly vague, ambiguous, and overbroad, lacking in specificity and clarity, in contravention of Article 24(2) of the Constitution.”
The petitioners ask the court to declare parts of the Act inconsistent with several constitutional rights, including: Freedom of expression, Access to information, Privacy, Fair administrative action Freedom of association
They also want sections of the law declared illegal for conflicting with Sections 25 and 27 of the Data Protection Act.
Justice Mugambi ordered that: Applications be served physically within three days.
Responses and submissions are to be filed within seven days after service.
The case will return to court on November 5, 2025, for further directions.
