MasiboLaw LLP

By Sarah Mukeku

On 1 September 2026, the High Court at Nairobi (Aburili, J.) delivered judgment in Bolt Operations OÜ v Cabinet Secretary for Roads and Transport & 3 Others [2026] KEHC 13383 (KLR), declaring Kenya’s regulatory framework for digital ride-hailing platforms procedurally defective and unconstitutional.

Key takeaways

• The NTSA (Transport Network Companies, Owners, Drivers and Passengers) Regulations, 2022 (Legal Notice No. 120 of 2022) were declared null and void for want of proper public participation.
• The 18% commission cap and the mandatory three-year data retention rule were separately found to be illegal by being beyond NTSA’s statutory powers.
• The Court suspended its declaration of invalidity for 12 months — which means that the Regulations remain formally in place while government fixes the process, but the commission cap and data retention rule cannot be enforced in the meantime.

Background

The Regulations, gazetted in 2022, created a licensing regime for ride-hailing platforms: a cap on driver commissions at 18% (Regulation 9), a ban on passenger booking fees, and a requirement that platforms retain trip and payment data for three years and hand it to NTSA on request.

Bolt Operations OÜ, the Estonian company behind the Bolt app, challenged the framework on three grounds:

• The commission cap and booking-fee restrictions were never put to stakeholders during consultation.
• No Regulatory Impact Statement was prepared, despite the significant economic impact on the sector.
• The Regulations took effect before being tabled before the newly constituted Parliament.

The Cabinet Secretary, NTSA, and the National Assembly opposed the petition, arguing that extensive nationwide consultation had taken place and that the Regulations were validly made.

What the Court Found

Procedural failure. Although some consultation had occurred, the Court held that the commission cap and booking-fee restrictions were never included in the draft put to stakeholders — a change of this magnitude required its own round of comment. The absence of a Regulatory Impact Statement, required given the sector-wide cost implications, compounded the defect: the statutory process for subsidiary legislation simply hadn’t been followed.

No statutory power to cap commissions. Beyond the process failure, the Court found that the NTSA Act doesn’t give NTSA the power to set commercial commission rates between platforms and drivers. The 18% cap was therefore ultra vires and inconsistent with Article 40 on protection of the right to property.

Data retention breaches privacy rights. Regulation 17’s three-year retention-and-surrender requirement was found to lack a sufficient legal basis and adequate safeguards, placing it in conflict with Article 31 (the right to privacy) and the Data Protection Act, 2019.

What Happens Next

The authorities have 12 months from 1 September 2026 to run fresh public participation, conduct a proper Regulatory Impact Assessment, and bring the framework into compliance. In the meantime, the 18% commission cap and the data-surrender requirement under Regulation 17 cannot be enforced. Where the framework ultimately lands will depend on that review.

Why This Matters for Businesses

The ruling is a reminder that a regulation’s substance and its process are both open to challenge. Before treating a new regulatory obligation as settled, businesses should ask: was this specific requirement actually put to stakeholders during consultation, and does the regulator have the statutory power to impose it in the first place? Both questions can undo a rule that looks final on its face.

At MasiboLaw LLP, we advise businesses on regulatory compliance, data protection and the legal implications of regulatory developments. For legal support, contact us at info@masibolaw.co.ke.