Kenya's delay in joining the Budapest Convention on Cybercrime has drawn sharp scrutiny in Parliament, with legislators questioning why the country has taken nearly 25 years to act on a critical international framework to combat cybercrime and facilitate cross-border access to electronic evidence.

The issue arose during a joint sitting of the National Assembly Departmental Committee on Communication, Information and Innovation, chaired by Dagoreti South MP, Hon. John Kiarie, on Tuesday, 8th October 2026, at Bunge Tower, where officials from the Ministry of ICT and the Digital Economy briefed Members on Kenya's proposed accession to the convention.

Adopted in 2001 by the Council of Europe, the Budapest Convention is the first international treaty seeking to address internet and computer crime by harmonizing national laws, improving investigative techniques and increasing cooperation among nations. It provides a comprehensive framework for international cooperation in investigating cybercrime, prosecuting offenders and accessing electronic evidence.

The Committee was informed that the Cabinet has approved Kenya's proposed accession to the Convention, following a lengthy process initiated by the Ministry of Interior and National Administration.

The Ministry of ICT and the Digital Economy told the Committee that it fully supports the move, noting that accession would significantly strengthen Kenya's response to escalating cyber threats and enhance cooperation among relevant state institutions responsible for cybersecurity.

However, Nandi Hills MP, Hon. Bernard Kibor Kitur, questioned the rationale for the 25-year delay, noting that Kenya has similarly failed to ratify other key instruments. He cited the African Union Convention on Cyber Security and Personal Data Protection, commonly known as the Malabo Convention, adopted in 2014, which Kenya has signed but not yet ratified.

Hon. Kibor called on the government to provide clear timelines on all international conventions and treaties awaiting action to avoid leaving the country exposed in an increasingly digital world.

Members also questioned the strategic decision to pursue the Budapest Convention, adopted in 2001, at a time when a newer United Nations Convention against Cybercrime exists. The legislators sought to understand whether the UN framework, negotiated with broader participation from developing countries, could better address gaps left by the older Budapest Convention.

In her response, Data Commissioner Immaculate Kassait defended the decision to join the Budapest Convention, arguing that the instrument remains relevant and dynamic.

Kassait noted that the Convention has evolved through amendments, including the Second additional Protocol adopted in 2021, which strengthens cooperation and the disclosure of electronic evidence.

She explained that the accession process had been slowed by the need to reach consensus among several key security and governance institutions, including the Ministries of Interior and Defence, the Office of the Data Protection Commissioner, and other agencies in the justice and security sector.

According to Kassait, Cabinet approval has now been secured after years of inter-ministerial consultations, and the government is conducting public participation in partnership with Mzalendo Trust, as required by the Constitution for the ratification of international treaties.

The Commissioner acknowledged that the prolonged delay had placed Kenya in an uncomfortable international position, particularly at a time when cybercrime is rising and the country is positioning itself as a regional technology hub.

Officials from the Ministry told the Committee that accession to the Convention would require all relevant institutions to implement its provisions within their mandates, while strengthening cybersecurity policies, enhancing the resilience of digital infrastructure, improving threat information sharing and bolstering incident response capabilities.

They added that joining the Convention would also have economic benefits, noting that the framework could help Kenya attract technology investment by creating a more secure, predictable and trusted digital environment for investors and service providers.

The Committee was further informed that Kenya has other international instruments in the pipeline awaiting ratification, including the Digital Cooperation Organisation (DCO) Convention, which has already been signed, and Convention 108 on the protection of individuals with regard to the automatic processing of personal data, which has a status similar to that of the Malabo Convention.

Committee Chairperson, Hon. John Kiarie, and members, including Hon. Kitur, criticised the persistent delays in processing international agreements, saying the Executive must act with greater urgency.

“The government is a continuous institution and should either move agreements through the ratification process within a reasonable period or make a clear decision not to proceed,” Kiarie said.

Kiarie emphasised that Parliament's role is to ensure that Kenya is not left behind in global efforts to secure cyberspace.

“Our priority remains clear; safeguarding Kenya's cyberspace, securing citizen data, and aligning our laws with global standards against cybercrime,” Kiarie said.

He also praised the ongoing engagement with other African legislatures.

“This was a valuable engagement among fellow African legislators on the shared responsibility to secure our increasingly connected societies,” he said.

ICT and Digital Economy Principal Secretary Eng. John Kipchumba Tanui noted that Kenya has two other conventions already signed, with ratification pending, and Convention 108, which has a status similar to Malabo.

He assured the committee that the Ministry is working closely with relevant agencies to fast-track the remaining steps once public participation concludes, with a view to tabling the instruments before Parliament for approval.