ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
28. Localisation of critical information
Edition: 2024-02-16 · In force
28. Localisation of critical information
(1)An owner of a critical information infrastructure shall ensure that the infrastructure on which critical information is domiciled is located in Kenya.(2)Without prejudice to paragraph (1), an owner of a critical information infrastructure who intends to have critical information located outside Kenya, shall apply the Committee in Form CMCA 3 set out in the Third Schedule.(3)The Committee shall consider the application submitted under paragraph (2), and verify that it meets the security standards provided under the Act and these Regulations, and shall communicate its decision within thirty days of receipt of the notification.(4)The Committee may, in considering an application by the operator to have critical information located outside Kenya take into account-(a)the security measures and safeguards being applied to the critical information infrastructure on which the information is contained meet the standards set out in the Act and these Regulations;(b)whether it is necessary for the information to be stored outside the geographical jurisdiction of the Republic;(e)security of data contained in the critical information infrastructure; and(f)submissions by any concerned operator.(5)The Committee shall consult the National Security Council and the relevant security agencies, when reviewing an application by the owner of a critical information infrastructure to have critical information located outside Kenya.