Technology contracts and online business: where the risk actually sits

Most technology disputes are not exotic. They arise from a short list of provisions that were either absent, misdescribed or copied from a template drafted for a different jurisdiction. This article covers the ones that decide outcomes for founders and organisations operating across Kenya and the United Arab Emirates.

Who owns what was built

Intellectual property ownership is the provision most often assumed rather than agreed, and Kenya’s default is unusual enough to catch out anyone working from British or American precedent.

Under section 31 of the Copyright Act, where a person commissions a work from someone who is not an employee under a contract of service, the commissioner acquires the copyright. Where a work is made in the course of employment under a contract of service, and was not commissioned, copyright transfers to the employer. Both are subject to contrary agreement.

That is the reverse of the position elsewhere, where a freelancer retains copyright absent a written assignment. Two practical points follow:

• A Kenyan business that commissioned a design, a photoshoot or a build is likely to own the output even without an express assignment — but should not rely on the default where the arrangement is arguably one of employment, or where the contract is silent on scope.
• A Kenyan creative or agency accepting commissioned work has, by default, given the copyright away. If that is not the intention, it must be excluded expressly.

Under section 33, a written assignment is not valid unless it is lodged with the Kenya Copyright Board and recorded. A carefully negotiated assignment clause that was never recorded may not achieve what the parties believe.

Three further ownership points worth settling in the contract rather than in a dispute:

• Pre-existing materials and tooling. A developer’s libraries, an agency’s templates. Usually licensed, not assigned; say so.
• Open-source components. Identify them and their licences. A copyleft component in a delivered codebase is a live constraint on the client’s business model, not a footnote.
• Moral rights. In Kenya these cannot be transferred during the author’s lifetime and survive assignment of the economic rights. An author who has assigned everything may still object to derogatory treatment or misattribution.

Controller, processor, and who carries the obligation

Data protection clauses are frequently drafted before anyone has established which party is doing what. The characterisation drives everything that follows.

Under Kenya’s Data Protection Act, a controller determines the purpose and means of processing; a processor processes on the controller’s behalf. Section 65 splits liability accordingly: the controller is liable for damage caused by processing, and the processor is liable only for breach of processor-specific obligations or for acting outside the controller’s instructions.

Three provisions are commonly missing from Kenyan processor agreements:

• The 48-hour processor notification. Section 43 requires the controller to notify the Data Commissioner within 72 hours of becoming aware of a breach where there is a real risk of harm, and requires a processor to notify the controller within 48 hours. A contract that says only “promptly” leaves the controller unable to meet its own statutory deadline.
• Transfer restrictions. Sections 48 and 49 govern transfer outside Kenya, with a stricter rule for sensitive personal data requiring consent and confirmation of safeguards. Hosting location and sub-processor location are contractual questions, not just technical ones.
• Registration. Registration with the ODPC is required unless annual turnover is below KES 5 million and the entity employs fewer than ten people — and it is mandatory regardless of size for a list of sectors including financial services, telecommunications, direct marketing, ride-hailing, health administration and the operation of an educational institution. A small venture in one of those sectors is not exempt.

Where personal data is put to commercial use, section 37 requires express consent or statutory authorisation with prior notification. Marketing permissions collected as a pre-ticked box or bundled into general terms will not carry that weight.

The UAE: establish which regime applies before drafting

The United Arab Emirates does not have one data protection regime. It has several, and the applicable one depends on where the entity sits.

The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in force since January 2022. Its scope provision expressly excludes entities in free zones that have their own data protection legislation, along with government data, security and judicial authority data, health data governed by separate legislation, banking and credit data governed by separate legislation, and processing by an individual for purely personal purposes.

Its Executive Regulations have not been issued, and as a result the administrative penalty framework contemplated by the law remains undefined and the compliance period it provides for has not begun to run. The accurate description is that the federal law is in force but has not yet become an operative enforcement regime. It should not be presented to a client as a functioning European-style framework.

The free-zone regimes are a different matter and are being actively developed:

• The DIFC Data Protection Law No. 5 of 2020, as amended, is administered by its own Commissioner. Amendments enacted in July 2025 introduced a private right of action allowing data subjects to sue controllers and processors directly in the DIFC Courts for contraventions causing damage, including non-financial loss such as distress, without first going to the Commissioner. Fines for several contraventions were increased at the same time. A separate 2023 regulation addresses autonomous and AI systems in data processing.
• The ADGM Data Protection Regulations 2021 require registration with the Commissioner before processing — a divergence from both the DIFC and the federal regime — and impose a 72-hour breach notification.

For a business structured across onshore and free-zone entities, the group’s data flows may cross regimes internally. That should be mapped before contracts are drafted, not after a breach.

Separately, the cybercrime law provides a criminal route for personal data misuse in the UAE that is live and enforceable now, independent of the administrative regime. Unauthorised acquisition or dissemination of personal data by electronic means is an offence carrying imprisonment and substantial fines. In practice, that is currently the more consequential exposure.

Platform dependency

A great many online businesses are built on infrastructure they do not control: an app store, a marketplace, an advertising platform, a payment processor, a social account that carries the whole customer relationship.

This is a contractual relationship, but not a negotiated one. The terms are unilateral, they change, and enforcement is automated. The realistic response is mitigation rather than negotiation:

• Know the termination and suspension provisions of every platform the business depends on, and what conduct triggers them.
• Understand the repeat-infringer exposure. Platforms are required, as a condition of their own safe harbours in the United States, to terminate repeat infringers in appropriate circumstances. A business accumulating copyright strikes is accumulating existential risk, not administrative friction.
• Hold the customer relationship off-platform where possible — owned domain, owned mailing list, exported records.
• Read the counter-notice consequences before instructing anyone to file one. A counter-notification under the US regime requires consent to the jurisdiction of a United States federal court; for a party outside the United States, that means any district in which the service provider may be found.
• Keep an evidenced account history. Appeals succeed on records, and platforms rarely explain decisions in useful detail.

Marketing, content and regulated activity

Online commercial activity directed at UAE audiences engages a licensing regime that many foreign businesses do not expect. Federal Decree-Law No. 55 of 2023 regulating media activities, in force since December 2023, is implemented through Cabinet Resolution No. 68 of 2024 and, since May 2025, a fee schedule and a published schedule of violations and penalties. Media entities require both a trade licence and a permit from the UAE Media Council; influencers and paid-advertising accounts require a permit, must clearly disclose promotional content and material benefits, must not mislead, and may not promote certain categories of product. Penalties under the published schedule run from written warnings to fines in the hundreds of thousands of dirhams, with repeat violations liable to be doubled.

Businesses whose users include minors should also note two recent UAE instruments: a child digital safety law issued in 2025 and in force from January 2026, applying to digital platforms and service providers operating in or directed at UAE users, with a compliance deadline in January 2027; and a 2026 Cabinet Resolution restricting personal social-media accounts for under-15s and imposing restricted accounts for 15- and 16-year-olds, with a twelve-month compliance window and express rejection of self-declared age as sufficient verification. Both are supervised by UAE regulators and both reach services directed at UAE users from outside the country.

Liability, warranties and the dispute clause

The provisions that determine what a dispute costs are usually the least discussed at signature.

• Limitation and exclusion of liability. Caps expressed as a multiple of fees are standard; carve-outs for confidentiality, IP infringement, data protection breach and wilful misconduct are where the negotiation actually is. Note that under the UAE civil law that came into force in 2026, clauses excluding or limiting liability for a harmful act are void — an exclusion clause drafted for a common-law counterparty may not survive there.
• Service levels and remedies. A service credit is a remedy only if it is meaningful relative to the loss. Most are not; they are a pricing mechanism.
• Governing law and forum. Choose deliberately, and choose something enforceable against the counterparty’s assets. Enforcement of a foreign judgment in the UAE runs through statutory conditions including a public-order gate, and there is no verified reciprocal enforcement treaty between Kenya and the UAE. Arbitration, with a seat chosen for enforceability under the New York Convention, is frequently the more practical answer for a cross-border technology contract than either party’s home court.
• Data and exit. What is returned, in what format, within what period, and what is deleted. An exit clause that says “reasonable assistance” will not extract a database from an uncooperative supplier.

The short list

Before signing a technology agreement with Kenyan or Emirati connections, confirm: who owns the output and whether the assignment has been recorded; which party is controller and which processor; which data protection regime applies to each entity; what happens on breach and within what hours; whether any activity requires a licence or permit; where liability is capped and what falls outside the cap; and where a dispute will actually be heard and enforced.