According to Section 3 of the National Payment System Act, the Central Bank is empowered to designate a payment system. In addition, Section 12 prohibits unauthorised companies from conducting business with a payment service provider. Furthermore, pursuant to Art. 43 of the National Payment System Regulations, e-money issued shall be subject to an individual transaction limit that shall not exceed seventy thousand shillings (approx. USD 560) and an aggregate monthly load limit of one million shillings (approx. USD 7,990), provided that the Central Bank may approve higher limits for specific categories of e-money issuers. The limits may be amended by the Central Bank from time to time.

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is KSH 2,580 (approx. USD 20), below the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

The Kenya Information and Communications (Consumer Protection) Regulation provides a comprehensive consumer protection framework that applies to online transactions.

Kenya has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Kenya has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Kenya has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

It is reported that there is a requirement to obtain a Certificate of Conformity from a Kenya Bureau of Standards appointed pre-export verification of conformity (PVoC) partner. To import any commodity into Kenya, an importer has to enlist the services of a clearing agent who will process the import documentation through Kenya Customs electronically on the Simba 2005 system and clear the goods on the company's behalf. It is the seller’s responsibility to ensure that shipments to Kenya happen only after issuance of a Certificate of Conformity. In addition, products containing the QMark do not have to go through inspection for compliance upon entry into another Partner State of the East African Community.

Companies have expressed concerns regarding the prolonged duration for Kenyan Customs to release shipments, along with the excessive formalities involved. The one-stop customs clearance system in Kenya reportedly does not function as expected, and the pre-arrival processing of electronic documents is ineffective. Additionally, there are reports of inconsistent application of classification and valuation decisions within the system, as well as unnecessary transit inspections.

According to the Communications Authority of Kenya, an application for Type Approval must be made using the Application Form for Type Approval/Type Acceptance of ICT Equipment. It is reported that the homologation procedure in Kenya is more complicated than in most African countries. Depending on regulations and type of equipment, the authority may require product samples for further examination or simply issue an exemption letter. The validity period of conformity documents can be unlimited (exemption letters) or limited to 6 months (certificates of conformity) after which the authority automatically issues an unlimited certificate.

The Environmental Management and Coordination (Extended Producer Responsibility) Regulations impose obligations for importers of used electronic goods such as licences, registration for compliance schemes and reporting to ensure that the products comply with the Extended Producer Responsibility (EPR), amongst other requirements.

Section 26.1 of the National Payment Act provides that the Central Bank, the Central Bank settlement system participants, payment clearing house system operators and system operators shall retain all records obtained by them during the course of the operations and administration of a payment system or the issuance of a payment instrument, for a period of seven years from the date of each particular record.

Section 31 of the Data Protection Act No. 24 of 2019 requires the performance of protection impact assessment in cases where a processing operation is likely to result in high risk to the rights and freedoms of a data subject by virtue of its nature, scope, context and purposes.

Section 27.3 of Act No. 3 empowers the Anti-Corruption Commission to issue a notice requiring any person to provide, within a reasonable time specified in the notice, any information or documents in the person’s possession that relate to a person suspected of corruption or economic crime. This notice does not require a court order or court warrant and may be issued when the Anti-Corruption Commission is investigating financial crimes.

Pursuant to Section 42 (1) and (2) of the National Intelligence Service Act 2012, the Director General of Intelligence may obtain warrants from the High Court of Kenya to obtain any information and monitor communication in order to preserve national security.
Despite the law requiring a warrant, an investigation by Privacy International in March 2017 revealed that the National Intelligence Agency (NIS) has direct access to Kenya’s telecommunications networks, which allows for the interception of both communications data and content. Direct access describes situations where state agencies have a direct connection to telecommunications networks, which allows them to obtain digital communications content and data (mobile and/or internet) without prior notice or judicial authorisation and without the involvement of the telecommunications provider or internet service provider that owns or runs the network.

Section 6 of the Official Secrets Act requires “any person who owns or controls any telecommunications apparatus used for the sending or receipt of any data to or from any place outside Kenya” to provide such data to the government. Such requests may be authorised by the president’s cabinet security rather than through the courts. Those who refuse risk a one-year prison term, a fine of 1 million shillings (USD 8,800), or both.