What Are the Regulatory Requirements for ISP Billing in Kenya?

Two layers of regulation matter here — one already in force, one still proposed.

Already in effect: the Kenya Information and Communications (Consumer Protection) Regulations, 2026. Issued by the Cabinet Secretary for ICT and the Digital Economy with the Communications Authority of Kenya, replacing the 2010 rules, these require licensees (including ISPs) to run a customer care system accessible through multiple channels — physical offices, phone, and electronic platforms — including accessibility for people with disabilities. Complaints must be acknowledged, tracked with a reference number, and resolved free of charge, with an escalation path to the Authority. Shutting down a service now requires prior Authority approval and at least three months' notice to affected subscribers, who must be able to leave without penalty and recover unused balances. Non-compliance is now a criminal offense, with penalties that can include a substantial fine and potential imprisonment. Licensees had a limited compliance window from when the regulations took effect.

Already in effect: the Data Protection Act, 2019. ISPs hold customer names, ID numbers, phone numbers, addresses, and payment records, making them data controllers/processors under the Act, enforced by the Office of the Data Protection Commissioner (ODPC). Core obligations: register with the ODPC, process data lawfully and transparently, avoid retaining data longer than necessary, and — for larger-scale processing — appoint a Data Protection Officer and run Data Protection Impact Assessments.

Still proposed, not yet law: the Kenya Information and Communications (Amendment) Bill, 2025. If passed, it would require metered, consumption-based billing, a unique "internet meter number" per customer, and annual billing reports to the CA. As of mid-2026 it had only reached First Reading and committee review — not current law, and smaller ISPs have raised cost concerns about building metering infrastructure.

A practical note for your billing/operations platform choice: the 2026 Consumer Protection Regulations effectively require a traceable, multi-channel customer care system — which is a support-ticketing feature, not a billing feature. A platform that only handles invoices leaves you needing a separate system just to stay compliant on this point. See CA Kenya Compliance and ISP Billing for what this means practically.

This article is for general awareness, not legal advice — consult a licensed advocate or the Communications Authority of Kenya directly for compliance decisions specific to your business.