Kenya Media Law Guide

Defamation, Privacy and Data Protection


Kiragu Kimani

Kiragu Kimani

Partner - Dentons Hamilton Harrison & Mathews

Queenton Ochieng

Queenton Ochieng

Senior Associate - Dentons Hamilton Harrison & Mathews

Nimo Kering

Nimo Kering

Associate Dentons Hamilton Harrison & Mathews


Defamation and Privacy Law in Kenya

Contributors: Kiragu Kimani (Partner), Queenton Ochieng (Senior Associate) and Nimo Kering (Associate), Dentons Hamilton Harrison & Mathews


The law of defamation in Kenya falls under civil law and is governed by the Defamation Act[1].

Defamation was previously criminal and civil in nature. The criminal element of defamation was however declared unconstitutional in the case of Jacqueline Okuta & another v Attorney General & 2 others [2017] eKLR. The Constitutional and Human Rights Division of the High Court of Kenya in this case declared Section 194 of the Penal Code, which relates to criminal defamation, unconstitutional. The Court held that the offence of criminal defamation infringed on the constitutional right to speak and the right to know. This in the court’s view would be deleterious if it was retained as a criminal offence. The court also held that defamation having an alternative civil remedy in the form of damages was reason enough to eschew the resort to criminal defamation. Invoking criminal defamation to protect one’s reputation was “disproportionate and therefore excessive and not reasonably justifiable in an open democratic society based on human dignity, equality and freedom.”

The law of privacy initially fell only under civil law in Kenya. The relevant statute is Article 31 of the Constitution of Kenya which provides that:

31. Every person has the right to privacy, which includes the right not to have—

(a) their person, home or property searched;

(b) their possessions seized;

(c) information relating to their family or private affairs unnecessarily required or revealed; or

(d) the privacy of their communications infringed.

Data Protection

The Data Protection Act was enacted on 8 November 2019. The Data Protection Act gives effect to Articles 31(c) and (d) of the Constitution of Kenya which guarantee the right of every person not to have “information relating to their family or private affairs unnecessarily required or revealed” and the right not to have “the privacy of their communications infringed”. The new statute now creates several offences as follows:

(i) A data controller[2] or data processor[3] who knowingly supplies any false or misleading detail when registering with the Data Commissioner commits an offence[4].

(ii) A data controller or data processor who fails to comply with the procedures set out in the Data Protection Act when applying for registration commits an offence[5].

(iii) A data controller or data processor who process personal data unlawfully commits an offence[6].

(iv) Any person who, without reasonable excuse, fails or refuses to comply with a notice, or who furnishes to the Data Commissioner any information which the person knows to be false or misleading, commits an offence[7].

(v) Any person who, without reasonable excuse, fails to comply with an enforcement notice commits an offence and is liable on conviction to a fine not exceeding five million shillings or to imprisonment for a term not exceeding two years, or to both[8].

(vi) Any person who obstructs the Data Commissioner in undertaking his work pursuant to the powers given in the Act commits an offence and is liable on conviction to a fine not exceeding five million shillings or to imprisonment for a term not exceeding two years, or to both[9].
(vii) A data controller who, without lawful excuse, discloses personal data in any manner that is incompatible with the purpose for which such data has been collected commits an offence[10].

(viii) A data processor who, without lawful excuse, discloses personal data processed by the data processor without the prior authority of the data controller commits an offence=[11].

(ix) A person who obtains access to personal data, or obtains any information constituting such data, without prior authority of the data controller or data processor by whom the data is kept or discloses personal data to third party, commits an offence. (This does not apply to a person who is an employee or agent of a data controller or data processor acting within the scope of such mandate)[12]

(x) A person who offers to sell personal data where such personal data has been obtained in breach of subsection (1) commits an offence[13].

A person who commits an offence under the Data Protection Act for which no specific penalty is provided or who otherwise contravenes this Act shall, on conviction, be liable to a fine not exceeding three million shillings or to an imprisonment term not exceeding ten years, or to both[14].


An action for defamation may not be brought after the end of twelve months from the date on which the cause of action accrued[15].

An action for the infringement of one’s privacy under the Constitution of Kenya, on the other hand, does not have a limitation. Parties are allowed to file petitions seeking redress for the infringement of their privacy at any time. The time period must however be reasonable and any delay should be justifiable.


In order to succeed in a claim for defamation, the plaintiff must prove that:

(a) The publication complained of by the plaintiff was defamatory;

(b) The publications referred to the plaintiff;

(c) The words in the publication were published; and

(d) The statement was malicious[16].

The court in Joseph Njogu Kamunge v Charles Muriuki Gachari [2016] eKLR explained malice as follows:

“Malicious here does not necessarily mean spite or ill will but there must be evidence of malice and lack of justifiable cause to utter the words complained of. Evidence showing the defendant knew the words complained of were false or did not care to verify can be evidence of malice”

(e) For slander, there must be proof of resultant damage[17].

Pursuant to section 107 of the Evidence Act[18], the burden of proof lies on he who asserts the existence of a fact. The burden of proving that a statement is defamatory therefore lays on the plaintiff[19]. The plaintiff ought to show that the words used were defamatory in that they lowered the plaintiff’s reputation in the estimation of right-minded persons in the society. The words complained of must be shown to have injured the reputation, character or dignity of the plaintiff[20].

The burden of proof shifts to a defendant to prove any of the principal defences in defamation by virtue of section 107 of the Evidence Act in line with the phrase “he who alleges must prove”. The defendant must prove that the defamatory statement is substantially true for the defence of justification. Where a defendant intends to rely on qualified privilege, he/she must prove that the subject matter and its context was in advance of public interest or that the words were a fair comment on a matter.

A defamatory statement is presumed to be false, unless the defendant can prove its truth. Defamation law puts the burden of proving the truth of allegedly defamatory statements on the defendant, rather than the plaintiff. The plaintiff has no burden to prove the defence raised by the plaintiff[21].

The principal defences to a claim are as follows:


The defence of justification is set out in section 14 of the Defamation Act. Justification is assertion that the words published are true in substance and in fact. Failure to justify the defamatory words will expose the defendant to aggravated damages. There is no need to justify each and every fact provided the words that are not justified do not injure the plaintiff’s reputation. The defence of justification calls for the defendant demonstrating that the defamatory imputation is true. A defendant cannot get away with it by saying that he believed that the matter complained of was true. The burden is to prove the words are true[22].

Absolute privilege

Section 6 of the Defamation Act states that, “A fair and accurate report in any newspaper of proceedings head before any court exercising judicial authority within Kenya shall be absolutely privileged. “The defence of absolute privilege applies to fair and accurate reports relating to proceedings of high public importance such as court and parliamentary proceedings. The court in Khasakhala v Aurah (1995-1998) 1EA 112 stated that unlike qualified privilege which requires explanation, absolute privilege would be enjoyed by a defendant who has made a fair and accurate report in his newspaper provided that such a report does not contain blasphemous, seditious or indecent matter.

Qualified privilege

The defence of qualified privilege is set out in section 7 of the Defamation Act. This applies to a far wider range of occasions and reports – where the reporter has a moral or social duty to make the report and recipient has an interest to receive it. The reports must be fair and accurate. Any malice in the report will defeat the defence.

In Musikari Kombo v Royal Media Services Limited [2018] eKLR the court held as follows:

“The essence of this defence is an attempt to balance two competing but vital interests in society; the individual’s right to have their character and reputation protected and safeguarded from false, unwarranted and malicious or scurrilous attacks on the one hand, and the public’s right to know as exercised and fed by freedom of expression, which is an indispensable feature of a free and democratic society as well as a major tool for public accountability.”

Fair comment

The Defamation Act in section 15 states as follows:
“In any action for libel or slander in respect of words consisting partly of allegations of fact and partly of expression of opinion, a defence of fair comment shall not fail by reason only that the truth of every allegation of fact is not proved if the expression of opinion is fair comment having regard to such of the facts alleged or referred to in the words complained of as are proved.”

The defence of fair comment entails comments on matters that are of public interest. The defence applies to comments and not statement of facts. The facts upon which the comments ae based must be true or substantially true.

While there is no maximum level of financial compensation, the award of huge sums of damages in defamation cases is on the rise. The recent trends of damages awarded in Kenya are as follows:

(i) 2005: Daniel Musinga (then advocate, now Court of Appeal Judge) v Nation Newspapers Limited (2005) eKLR – Kshs. 4 million (approximately USD 40,000) – Court of Appeal

(ii) 2013: James Okoth Omburah (advocate) v Standard Media Group & Others (2013) eKLR – Kshs. 4.5 million (approximately USD 45,000) – Court of Appeal

(iii) 2013: Ambassador Chirau Ali Makwere v Royal Media Services (20130 eKLR– Kshs. 6 million (approximately USD 60,000)– Court of Appeal

(iv) 2014: KL (entertainer) v The Standard Limited (2014) eKLR– Kshs. 4 Million general damages (approximately USD 40,0000) and Kshs. 500,000 (approximately USD 5,000) aggravated damages. – High Court

(v) 2015: Samuel Ndungu Mukunya (High Court Judge) v Nation Media Group (2015) eKLR – Kshs. 20,000,000 (approximately USD 200,000) – High Court

(vi) 2016: Alnashir Visram (Court of Appeal judge) v Standard Media Group (2016) eKLR – Kshs. 26,000,000 (approximately USD 260,000) – High Court

There are no juries who sit in defamation, privacy or any kind of trials in Kenya.

Contributors: Kiragu Kimani (Partner), Queenton Ochieng (Senior Associate) and Nimo Kering (Associate)
Dentons Hamilton Harrison & Mathews
1st Floor, Delta Office Suites
Waiyaki Way
P.O. Box 30333-00100, Nairobi

The material in this Guide is for general information only and does not constitute legal advice.

[1] Chapter 36 of the Laws of Kenya
[2] A data controller is defined as a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data. See Data Protection Act Section 2.
[3] A data processor means a natural or legal person, public authority, agency or other body, which processes personal data on behalf of the data controller. See Data Protection Act Section 2
[4] Data Protection Act Section 19(3)
[5] Data Protection Act Section 19(7)
[6] Data Protection Act Section 30
[7] Data Protection Act Section 57(3)
[8] Data Protection Act Section 58(3)
[9] Data Protection Act Section 61
[10] Data Protection Act Section 72(1)
[11] Data Protection Act Section 72(2)
[12] Data Protection Act Section 72(3)
[13] Data Protection Act Section 72(5)
[14] Data Protection Act Section 72(6)
[15] Limitations of Actions Act, Section 4(2)
[16] See: John Ward v Standard Limited [2006] eKLR and Phinehas Nyagah v Gitobu Imanyara [2013] eKLR
[17] Joseph Musyoka Kalii v Musyoka Kilatya [2014] eKLR (Fifth element on resultant damage
[18] Chapter 80 of the Laws of Kenya
[19] See Samuel Ndung’u Mukunya v Nation Media Group Limited & another [2015] eKLR21]
[20] See Joseph Njogu Kamunge v Charles Muriuki Gachari [2016] eKLR
[21] See Hon. Uhuru Muigai Kenyatta v Baraza Limited (2011) eKLR and See Joseph Njogu Kamunge v Charles Muriuki Gachari [2016] eKLR
[22] See Hon. Uhuru Muigai Kenyatta v Baraza Limited (2011) eKLR

Our Newsletter