A Court Ruling With Teeth
On March 19, 2026, Justice Lawrence Mugambi of Kenya's High Court decided Odhiambo & another v Attorney General & another (Petition E290 of 2024), a case brought by a prisoner whose mobile number had been reassigned while he was incarcerated. The court held that mobile numbers are not mere technical resources belonging to telecom operators but personal digital identifiers protected under Article 31(c) and (d) of the Constitution, which guard against unnecessary exposure of private information (Capital FM Africa). It struck down the existing deactivation regime — Legal Notice 90 of 2025 — as "unreasonable and arbitrary" for failing to account for circumstances like imprisonment, and ordered the Attorney General, the Kenya Prisons Service, the Communications Authority of Kenya (CA), and the Office of the Data Protection Commissioner to build a compliant framework within six months.
That deadline lands September 19, 2026, and the CA has answered with draft procedural and technical safeguards now open for public comment through September 11 (CA Open Consultations). The rules require operators to flag a number after three months with no revenue-generating activity, spend a further three months attempting notification via KYC-registered contact details, publish at-risk numbers in newspapers and broadcast media 30 days before deactivation, and — the core privacy fix — "de-link and securely archive the personal data, cached data, and services associated with the previous owner" before the number goes to a new subscriber (TechCabal).
The Case for the Rule
The strongest argument for this framework isn't abstract. In a market where a phone number doubles as the login credential for mobile money, bank OTPs, and app recovery flows, an unprotected recycled number is a live fraud vector: whoever inherits it can potentially reset a stranger's M-Pesa PIN or intercept a banking verification code. The CA itself frames the initiative around exactly this risk, alongside the more mundane problem that Kenya has a finite numbering pool and cannot leave functioning ranges locked to dormant accounts indefinitely (Techweez). Justice Mugambi's underlying petitioner — a man who lost access to his number, and by extension his digital footprint, simply because he was in custody — is a sympathetic and legitimate harm that regulators are right to address. A framework that converts what TechCabal describes as "an old, informal practice" into a documented, auditable process is a defensible regulatory response, not a reflexive one.
Getting the Calibration Right
What's notable is how targeted Kenya's approach is compared to regional peers. TechCabal reports Kenya's six-month recycling window sits between South Africa's 90-day timeline and Nigeria's roughly one-year horizon — with South Africa exempting postpaid lines entirely and Nigeria leaning on opt-out marketing rather than data safeguards. Kenya's framework instead layers in specific carve-outs for prisoners and caregivers of the medically indisposed, and pairs the delay with a self-service USSD tool (*106#) that lets any subscriber check a number's status on demand. That's proportionate design: rather than picking an arbitrary uniform delay, the CA built in the exact populations the court's petitioner represented, while still returning numbering resources to circulation faster than Nigeria does.
Where the Rule Overshoots
The compliance mechanics are where the framework gets needlessly expensive. Quarterly newspaper and broadcast publication of at-risk numbers — TechCabal pegs the cost of a single placement at roughly $3,000–$6,000 — is a blunt, analog instrument bolted onto an otherwise digital-first process that already includes SMS notification and a USSD lookup tool. Print advertising was a reasonable default when regulators worried about reaching subscribers with no other channel; here it duplicates a notification system the CA is simultaneously requiring operators to build. Kenya's mobile penetration and SMS/USSD infrastructure make the newspaper mandate look like compliance theater rather than a meaningful additional safeguard, and it falls hardest on smaller operators without Safaricom-scale advertising budgets — a real barrier to entry dressed up as consumer protection.
The Verdict
Strip out the newspaper requirement and this is close to a model response to a genuine privacy gap: a court identified a real harm tied to a specific, sympathetic fact pattern, and the regulator built a framework that is more targeted than its regional counterparts rather than less. The de-linking and archiving mandate is the right fix for the actual risk — data inheritance by a stranger — and it doesn't freeze Kenya's numbering pool the way an indefinite retention rule would. Regulators elsewhere grappling with the same phone-number-as-identity problem, including in markets with far larger numbering pressure, could do worse than start from Kenya's six-month, carve-out-aware baseline and simply drop the print-media relic before it becomes precedent.