Defamation and Online Harassment Laws in Kenya

Kenyan courts apply the Constitution first, then written laws, and only where those do not reach a question, the substance of English common law and equity as it stood on 12 August 1897, adapted to local circumstances. For defamation, the Defamation Act consolidates and amends the statute law on libel, slander and other malicious falsehoods, while common-law rules fill the gaps the Act leaves.

Sources1Judicature Act (Cap. 8), s. 3(1)2Defamation Act (Cap. 36), long title

In Okuta v Attorney General (2017), the High Court declared section 194 of the Penal Code, the criminal defamation offence, unconstitutional and invalid except where it covers speech falling within Article 33(2)(a)-(d) of the Constitution, such as incitement to violence or hate speech. In March 2026 the Court of Appeal also held sections 22 and 23 of the Computer Misuse and Cybercrimes Act, the false publication offences, unconstitutional because they were too broad. Outside those narrow categories, a false statement that harms someone's reputation is pursued through a civil claim.

Sources3Okuta & another v Attorney General & 2 others [2017] KEHC 8382 (KLR), declarations4Bloggers Association of Kenya (BAKE) v Attorney General & 6 others [2026] KECA 430 (KLR), para. 1535Computer Misuse and Cybercrimes Act (Cap. 79C), ss. 22 and 23

A tort claim in Kenya generally must be filed within three years, but a claim for libel or slander must be brought within twelve months of the date the cause of action accrued. This shorter period was added to the Limitation of Actions Act by the Defamation Act.

Sources6Limitation of Actions Act (Cap. 22), s. 4(2) and proviso2Defamation Act (Cap. 36), s. 20

For slander, the Defamation Act removes the need to allege or prove special damage when the words are likely to disparage the claimant in their office, profession, calling, trade or business, or when they accuse a woman or girl of unchastity. For libel, the Act sets minimum damages when the libel concerns a serious offence: at least KSh 1,000,000 for an offence punishable by death and at least KSh 400,000 for an offence punishable by three or more years in prison.

Source2Defamation Act (Cap. 36), ss. 3, 4 and 16A

A person or body harmed by a damaging factual inaccuracy in a newspaper has a statutory right of reply. The request must be made in writing to the editor or publisher within 14 days of publication, and the right cannot be used more than six months after publication. The correction must be printed free of charge, with similar prominence, in the next possible edition. In a later libel case the court may add damages if the newspaper refused, and may reduce damages if the claimant did not use the right of reply. Separately, a defendant may offer evidence of an apology made or offered early on to reduce damages.

Source2Defamation Act (Cap. 36), ss. 7A and 16(1)

Truth (justification) and fair comment are the main defenses. Under the Act, justification does not fail just because not every charge is proved, provided the unproved charges do not materially injure the claimant's reputation in light of those that are proved; fair comment is treated the same way where not every fact is proved. Fair and accurate newspaper reports of court proceedings in Kenya are absolutely privileged, and reports listed in the Act's Schedule have qualified privilege unless malice is proved, subject to conditions set out in the Act.

Source2Defamation Act (Cap. 36), ss. 6, 7, 14 and 15 and Schedule

Kenya has no offence called cyberstalking. Persistent online targeting can fall under cyber harassment: it is an offence to wilfully communicate, directly or indirectly, with a person or someone they know when you know or ought to know the conduct is likely to make them fear violence or damage to their property. The maximum penalty is a fine of KSh 20 million, ten years in prison, or both.

Source5Computer Misuse and Cybercrimes Act (Cap. 79C), s. 27(1)(a) and (2)

The cyber harassment offence also covers communications that are wholly or partly indecent or grossly offensive and affect the person. A complainant, or an intermediary on their behalf, can ask a court to order the accused to stop the communications; the court may make an interim order and must decide the application within 14 days. In 2026 the Court of Appeal rejected a constitutional challenge to section 27.

Sources5Computer Misuse and Cybercrimes Act (Cap. 79C), s. 27(1)(c) and (3)-(5)4Bloggers Association of Kenya (BAKE) v Attorney General & 6 others [2026] KECA 430 (KLR), paras. 148-150

Kenya has no offence called doxxing. The Data Protection Act, however, makes it an offence to obtain personal data without the prior authority of the controller or processor that keeps it, or to disclose personal data to a third party. Employees and agents acting within their mandate are excluded.

Source7Data Protection Act, 2019 (Cap. 411C), s. 72(3)-(4)

It is an offence to transfer, publish or spread another person's intimate or obscene image, including by making a digital copy available for distribution or download. The maximum penalty is a fine of KSh 200,000, two years in prison, or both.

Source5Computer Misuse and Cybercrimes Act (Cap. 79C), s. 37