The digital economy in Kenya is expanding at an unprecedented pace, driven by the increasing demand for broadband connectivity, cloud services and digital infrastructure. This growth continues to attract entrepreneurs seeking to operate as Internet Service Providers (“ISPs”). While commercial considerations such as infrastructure deployment often take center stage, the legal framework governing the establishment and operation of an ISP is equally critical to its long-term success.
Legal compliance is not simply a licensing exercise but a foundational element of a sustainable ISP business. This article highlights the principal legal considerations that ISPs in Kenya should implement to build a compliant and commercially viable business.
-
Corporate structuring
The Communications Authority of Kenya requires all ISP license applicants to operate through a registered Kenyan entity with a registered office and permanent place of business. In practice, most ISPs are established as private companies limited by shares under the Companies Act, 2015, as this business structure provides limited liability, governance flexibility and greater opportunities for capital raising and investment.
Businesses should also consider the applicable local ownership requirements at the incorporation stage. Depending on the category of license, the Communications Authority requires foreign-owned licensees to ensure that at least 20% of their shareholding is held by Kenyan citizens within 3 years of the license being granted. Factoring this requirement into the corporate structure from the outset helps avoid future restructuring and facilitates ongoing regulatory compliance.
-
Telecommunications licensing
The Communications Authority administers the licensing regime under the Unified Licensing Framework, which adopts a technology-neutral approach. Accordingly, the license required depends on the nature of the services to be provided and whether the operator will own communications infrastructure or utilise existing networks. The main license categories include:
-
Application Service Provider (ASP): Applicable to operators providing internet services over leased communications infrastructure.
-
Network Facilities Provider (NFP): Applicable to operators that own, establish or deploy telecommunications infrastructure. NFP licences are issued under three tiers based on the scale of the proposed network. Tier 1 authorises the deployment of infrastructure across multiple counties or on a national scale, Tier 2 is intended for operators serving a single county, while Tier 3 caters to smaller, localised networks, including those operating within a sub-county or community.
-
Community Network and Service Provider (CNSP): Intended for operators providing connectivity in underserved and unserved areas.
Given the different rights, obligations and fees associated with each licence category, prospective ISPs should assess their proposed business model before submitting an application. Please also note that licenses issued are subject to renewal.
-
Infrastructure deployment
Obtaining an operational licence does not by itself authorise the deployment of telecommunications infrastructure. Depending on the proposed network, an ISP may be required to obtain spectrum assignments from the Communications Authority before utilising wireless technologies.
In addition, telecommunications equipment such as routers, modems, wireless access points, switches and transmission equipment must undergo the prescribed type approval process before being imported, marketed or deployed in Kenya. For a detailed discussion of the equipment approval requirements, see our article on the mandatory type approval of ICT equipment in Kenya.
-
Wayleaves and land access
The deployment of telecommunications infrastructure in Kenya requires compliance with national legislation and county regulations governing land access and wayleaves. ISPs installing fibre optic cables, communication towers, masts and related infrastructure must obtain wayleave rights and approvals from landowners and relevant public authorities, and pay applicable county wayleave fees.
Where electricity poles are used for fiber deployment, ISPs must enter into leasing agreements with the Kenya Power and Lighting Company (“KPLC”) in accordance with the Energy Act, Cap. 314, while also adhering to technical standards and infrastructure-sharing requirements set by the Communications Authority.
-
Data protection
ISPs routinely process volumes of personal data, including subscriber identification records, billing information, installation records, IP addresses, traffic data and customer usage information. Consequently, ISPs are required to register with the Office of the Data Protection Commissioner(“ODPC”) as data controllers, data processors or both, depending on the nature and extent of their processing activities as per the Data Protection Act, 2019. To get more information on the requirements of registration of data controllers and data processors, please see our article.
-
Tax compliance
Before commencing operations, every ISP should obtain a KRA PIN and ensure compliance with all applicable tax obligations. Operators should also maintain a valid Tax Compliance Certificate, as the Communications Authority require evidence of tax compliance during licensing and licence renewal processes.
-
Intellectual property
An ISP’s intellectual property includes its brand, websites, customer portals, software and other proprietary technologies that underpin its business. Operators should protect these assets by registering their trademarks, ensuring that intellectual property created by employees and contractors is assigned to the business itself and safeguarding confidential business information through appropriate contractual arrangements.
ISPs should also implement clear procedures for receiving and responding to intellectual property infringement notices, including copyright takedown requests, to minimise legal risk and support compliance with applicable laws.
Conclusion
Establishing an ISP in Kenya requires legal and regulatory planning from the outset. Businesses that integrate compliance into their market entry strategy are better positioned to secure regulatory approvals, attract investment, minimise risk and build resilient enterprises capable of sustained growth. In an increasingly competitive digital economy, a strong legal foundation is a strategic advantage.
How We Can Help You
Establishing and operating an ISP requires navigating a legal and regulatory landscape. At CM Advocates LLP, we advise telecommunications operators, technology companies and investors on the legal and commercial issues arising throughout the lifecycle of their businesses. Our services include:
-
Corporate structuring and regulatory advisory for market entry;
-
Telecommunications licensing and regulatory compliance before the Communications Authority of Kenya;
-
Drafting and negotiating commercial agreements, including infrastructure, wayleave and technology contracts;
-
Data protection, consumer protection and cybersecurity compliance;
-
Intellectual property protection, commercialisation and enforcement; and
-
Ongoing regulatory and commercial advisory for telecommunications and digital businesses.
If you are considering establishing an ISP in Kenya or require advice on any telecommunications or technology-related matter, please contact the contributor below or reach out to our Intellectual Property, Brands and Commercialisation team at ipbc@cmadvocates.com.
Contributor
Mercy Chore, Associate
mchore@cmadvocates.com
Disclaimer:
This publication is for informational purposes only and does not constitute legal advice. For tailored legal support, please consult our team.