INTRODUCTION
In 2024 Kenya was promised the largest digital investment in its history: a USD 1 billion (about Kshs. 129 billion) geothermal‑powered data centre at Olkaria by Microsoft and Abu Dhabi’s G42, scaling to one gigawatt. By May 2026 it should have been switched on. Instead, it stalled.
The reason is not the one most people assume. Kenya did not lose that project to weak law, corruption or red tape. It lost it to arithmetic: one gigawatt is roughly a third of everything this country generates. As the President put it, switching it on would have meant switching off half the country. Data centres are not software. They are heavy industry, and the law governing them sits as much in the Energy Act as in the Data Protection Act.
WHY THE WORLD IS STILL LOOKING AT KENYA
Investors screen data centre destinations on clean affordable power, fast connectivity and legal predictability, and Kenya scores unusually well on all three. Over 90% of our electricity comes from geothermal, hydro and wind and Olkaria offers what almost no rival country can, renewable power that still runs at night, when solar cannot. The response has been real rather than rhetorical: iXAfrica’s NBOX1 campus on Mombasa Road is East Africa’s first AI‑ready hyperscale facility and has financed a further 20MW; Airtel’s Nxtra is building 44MW inside the Tatu City Special Economic Zone; EcoCloud’s “Project Eagle” is rising inside KenGen’s Green Energy Park; and Greece’s Amaco Energy Group has proposed a USD 1.5 billion, fully off‑grid facility at Mombasa. The pipeline is genuine. It is simply being built at a size the grid can carry.
WHAT HAS ACTUALLY CHANGED IN THE LAW
A data centre is now regulated infrastructure, not a warehouse
The Communications Authority’s Revised Telecommunications Market Structure, gazetted in March 2026, moved commercial data centres into the Network Facilities Provider tiers. An operator will ordinarily need an NFP‑T2 licence; Kshs. 15 million for fifteen years, plus 0.4% of gross turnover annually. The point is not the fee, but that these buildings now carry national security, reporting and service‑quality duties a landlord of racks never had.
Your data is being pulled home
Sections 48 to 50 of the Data Protection Act, 2019 already limit sending personal data abroad. The Data Commissioner’s Draft Guidance Note on Cross‑Border Data Transfers, 2026 goes further, treating sectors as broad as basic education and primary healthcare as matters of “strategic interest of the State” to be processed on servers in Kenya. It is still a draft, and industry has objected, but the direction is unmistakable.
AI rules are arriving ahead of AI capacity
The National AI Strategy 2025–2030 has been joined by an Artificial Intelligence Bill, 2026, published as a Senate Bill but not yet tabled. It proposes a four‑tier risk classification, an Office of the Artificial Intelligence Commissioner with inspection and audit powers, and a public register of high‑risk systems. Anyone who will live under this law should speak now, while it can be amended.
Foreign ownership is no longer a barrier
Gazette Notice No. 11079 of 22nd August 2023 deleted paragraph 6.2.4 of the National ICT Policy Guidelines, 2020, removing the 30% local equity requirement for ICT licensees. Wholly foreign‑owned data centre companies are now perfectly lawful here.
Power is now the first legal question
Under the Energy Act, 2019, only own‑use generation and isolated mini‑grids not exceeding one megawatt escape licensing. Any “off‑grid” plant of hyperscale size therefore needs a full generation licence from EPRA, with public notice, environmental and decommissioning obligations. The exemption promoters routinely cite does not cover the projects they are promoting.
WHY THIS MATTERS TO THE ORDINARY KENYAN
- Electricity: Every megawatt promised to a data centre is a megawatt not promised to a household or a factory. The law that forced Olkaria to be rescoped is the same law that protects your supply.
- Your records: Hospital files, school records and payment histories are the data being argued over. Where it physically sits decides whether a Kenyan court can reach it when something goes wrong.
- Water and land issues: Data centres need NEMA impact assessment and county planning approval. Cooling water demand at Mombasa and Athi River is a live community concern, and the Amaco proposal’s silence on water impact is the kind of omission that turns licensing into litigation.
THE TAKE HOMES
One. Kenya’s law is ready. Kenya’s grid is not and that, not regulation, is the binding constraint.
Two. Right‑sized projects are winning while the gigawatt promise is rescoped.
Three. Secure the power before the property and remember “off‑grid” is not “unregulated”: anything above one megawatt needs an EPRA licence.
Four. Do not bank on a Government guarantee. The Treasury declined one at Olkaria.
Five. Data localisation is tightening. Plan for Kenyan hosting of health, education and financial data.
Six. Engage the AI Bill now. Once enacted, the compliance burden is no longer negotiable.
THE BOTTOM LINE
Kenya is legally ready to host the world’s data.
Our data protection regime is mature, our licensing framework is newly modernised, and our ownership rules are among the most open on the continent. What we are not yet ready for is the appetite of gigawatt‑scale artificial intelligence and Olkaria proved that in public rather than in a boardroom. The Government’s 10GW target for 2030 will eventually change the arithmetic. Until it does, the projects that succeed here will be those that secured their power lawfully built by people who understood that in this sector, the energy lawyer sits at the table before the data lawyer does.
This article is provided free of charge for information purposes only; it does not constitute legal advice and should be relied on as such. No responsibility for the accuracy and/or correctness of the information and commentary as set in the article should be held without seeking specific legal advice on the subject matter. If you have any query regarding the same, please do not hesitate to contact Data Protection & ICT Law Department at Wamae & Allen LLP: WAICTLaw@wamaeallen.com.
About the author
Preston Ndombi Wawire is an experienced litigator of over 10 years standing and has perfected his art in civil and commercial litigation. He has vast experience in banking and recoveries litigation, insurance and malpractice law, and securities enforcement. Prestone has been involved in some of the most ground breaking litigation in injunctive matters and medical malpractice. Prestone is an active member of the Law Society of Kenya, Environment and Land Court Bar Bench Committee.
Denis Mutugi specializes in Commercial Litigation and Alternative Dispute Resolution.
Denis graduated with a Bachelor of Laws, LLB (Hons) from The University of Nairobi in 2021 and was admitted to the Roll of Advocates of the High Court of Kenya in the year 2023.
Denis has amassed a considerable wealth of experience in conducting legal research on various complex legal matters touching on Commercial, Insurance, Employment and Insolvency law and bankruptcy.
