The move puts Kenya’s cyber cafés at the centre of a growing debate over the balance between digital security and personal privacy. It is through this licensing framework that the CA has imposed the new operational requirements on Public Communications Access Centres. It is a condition of the PCAC Class Licence issued by the Communications Authority under the Kenya Information and Communications Act. This is particularly important because cyber cafés range from relatively sophisticated digital service businesses to small neighbourhood shops with limited technical resources. But the three-year retention requirement still means cyber cafés will become custodians of identifiable customer records for a significant period.