Kenya has data protection laws. It has cybercrime legislation. It has regulatory authorities, compliance frameworks, and enforcement mechanisms on paper. Yet cyber fraud, phishing, SIM swaps, impersonation, and digital scams continue to grow at a pace that outstrips legal reform.

This raises an uncomfortable question: If the legal framework exists, why are citizens still being exploited online?

The answer is not technological. It is human.

Modern cybersecurity policy assumes that the primary threat comes from unauthorized access to systems — hackers breaching firewalls, infiltrating networks, and stealing data. But in Kenya and across much of the Global South, the majority of cyber harm does not occur through sophisticated technical intrusion. It occurs through social engineering: the deliberate manipulation of human psychology to extract information, money, or access.

This reveals a structural blind spot in contemporary data protection frameworks. The law protects systems. Cybercriminals attack people.

Until policy begins to centre human vulnerability, data protection regimes will remain reactive, incomplete, and ineffective.

The illusion of legal protection

Kenya’s Data Protection Act establishes a comprehensive rights framework. It recognizes consent, lawful processing, data subject rights, and obligations for controllers and processors. On its face, it mirrors global best practice. The Computer Misuse and Cybercrimes framework criminalizes unauthorized access, identity theft, and digital fraud.

Legally, the architecture exists. But the everyday reality of cyber harm reveals a gap between legal design and human behavior.

Most cybercrime victims do not experience a system breach. They experience deception. They voluntarily disclose information because they believe they are interacting with legitimate actors. They trust authority. They respond to urgency. They act under psychological pressure.

In these scenarios, the law’s foundational assumption — that individuals exercise rational, informed consent — collapses. Consent manufactured through deception is not consent in any meaningful sense, yet current frameworks struggle to conceptualize harm that arises from manipulation rather than intrusion.

The result is paradoxical: victims appear to have “participated” in their own exploitation, and legal remedies become blurred.

This is not a failure of intelligence or literacy. It is a feature of human cognition.

The psychology cybercriminals exploit

Cybercrime succeeds because it targets predictable human tendencies:

• trust in authority

• fear of loss

• urgency under pressure

• desire for reward

• social compliance

• cognitive overload

Psychological research shows that people do not make decisions in a purely rational manner, especially under stress or time pressure. Social engineering attacks are engineered precisely to trigger emotional responses before analytical reasoning can intervene.

A phishing message does not rely on technical brilliance. It relies on human reflex.

A SIM swap succeeds because someone trusts a voice claiming institutional legitimacy.

An impersonation scam works because the victim fears immediate financial harm.

Cybercriminals are not primarily technologists. They are behavioural strategists.

This insight is crucial. It shifts cybersecurity from a technical battlefield to a psychological one. And yet, most legal frameworks still conceptualize cyber harm as a technological breach rather than a human manipulation.

That mismatch explains why enforcement lags behind reality.

Human factors in the Global South

The Global South faces unique structural conditions that intensify vulnerability:

• rapid digital adoption without parallel digital literacy

• mobile-first economies built on trust-based transactions

• informal financial ecosystems

• high unemployment driving cybercrime participation

• limited reporting and remedy mechanisms

• cross-border platform dependency

Digital infrastructure has expanded faster than social protection systems. Millions enter online ecosystems without safety education, consumer protection awareness, or institutional recourse when harm occurs.

In such environments, cybersecurity cannot be separated from socioeconomic context. Cybercrime is not merely an IT problem; it is a social problem embedded in inequality, access, and governance.

Victims are often blamed for negligence instead of recognized as targets of behavioural exploitation. This creates secondary victimization: the harm is compounded by stigma and lack of support.

A legal system that punishes intrusion but fails to address vulnerability treats symptoms, not causes.

The economy of cybercrime

Cybercrime persists because it is profitable, scalable, and low-risk. The digital marketplace rewards attackers who exploit human weakness more efficiently than those who attack infrastructure.

From a purely economic perspective, social engineering offers:

• low operational cost

• global reach

• high return

• minimal technical skill requirement

• jurisdictional insulation

This creates a rational incentive structure. Where profit is high and enforcement is weak, crime expands.

Legal frameworks that focus solely on punishment without altering the incentive landscape cannot succeed. Effective cybersecurity policy must understand cybercrime as an economic system, not isolated acts.

Data itself has become currency. Personal information is monetized, traded, weaponized, and recycled across networks. Every successful social engineering attack feeds a larger marketplace of stolen identities and credentials.

The law regulates databases. The underground economy regulates behavior. Until the former addresses the dynamics of the latter, the imbalance remains.

Compliance is not protection

Many organizations equate compliance with security. They implement privacy policies, data registers, and formal safeguards. These measures satisfy regulatory requirements but do little to prevent social engineering attacks that bypass systems entirely.

A perfectly compliant institution can still lose data if employees are manipulated.

A secure server cannot defend against a human persuaded to disclose credentials.

This distinction is critical. Data protection by design must incorporate human-centred security, not merely technical architecture.

Training, behavioural awareness, and institutional culture are as important as encryption and firewalls. Yet legal frameworks rarely mandate or meaningfully evaluate the human dimension of security.

Compliance measures protect institutions. Human-centred design protects people.

Why the law struggles to keep up

Cyber law evolves slowly. Social engineering evolves rapidly.

Legislation reacts to harm that has already occurred. Cybercriminal innovation anticipates the next vulnerability. This asymmetry ensures that law remains perpetually behind.

Cross-border enforcement compounds the problem. Many attacks originate outside national jurisdictions. International cooperation mechanisms exist but are slow, bureaucratic, and resource-intensive. Meanwhile, digital harm occurs in seconds.

The Global South faces additional enforcement constraints:

• limited investigative capacity

• underfunded cyber units

• judicial backlog

• technological dependence on foreign platforms

Legal frameworks without enforcement infrastructure become symbolic rather than protective.

Citizens experience the law as distant and abstract while cybercrime feels immediate and personal.

Toward a victim-centred cybersecurity model

If the human factor is the true vulnerability, then cybersecurity must become human-centred.

This requires a shift from reactive punishment to proactive protection:

1. Behavioural cybersecurity education integrated into public policy

2. Victim-centred legal remedies that remove stigma and simplify reporting

3. Mandatory human-factor risk assessments for institutions

4. Platform accountability for social engineering vectors

5. Cross-border rapid response cooperation

6. Economic disruption strategies targeting cybercrime markets

7. Digital literacy as social protection, not optional awareness

This is not merely a legal reform agenda. It is a governance transformation.

Cybersecurity must be treated as public safety, consumer protection, and social policy simultaneously.

The real frontier of data protection

The future of data protection is not only encryption standards, compliance audits, or regulatory fines. It is the recognition that human behaviour is the primary attack surface.

As long as policy assumes rational actors in an irrational environment, exploitation will continue.

Data protection frameworks that ignore psychology protect databases, not citizens.

The Global South has an opportunity to lead by acknowledging this reality early. Instead of replicating models built for different socioeconomic contexts, policy can be designed around actual lived vulnerability.

That is where meaningful protection begins.

Because cybercriminals are not breaking systems.

They are breaking trust.

And trust is a human problem.