Governance · 7 min read
The Kenya Data Protection Act and AI: what businesses need to know
How the Data Protection Act 2019 applies when you use AI with customer or staff data in Kenya.
Short answer
If your AI system processes personal data of people in Kenya, the Data Protection Act 2019 applies. You need a lawful basis, must be transparent, collect only what you need, secure the data, respect data-subject rights, and assess high-risk processing, including automated decisions such as AI credit scoring.
This article is general information, not legal advice. Consult a qualified advocate or the Office of the Data Protection Commissioner (ODPC) for your specific situation.
Does the Data Protection Act apply to AI?
Yes. The Act regulates the processing of personal data, whatever technology is used. Using AI to analyse customer records, screen CVs, score loans or answer customer chats all involve processing personal data.
Key principles to follow when using AI
- Lawful basis: have a valid reason, such as consent or contract, for processing
- Purpose limitation: use data only for the purposes you told people about
- Data minimisation: feed the AI only the data it needs
- Accuracy: keep data up to date and correct errors
- Security: protect data with access control and encryption
- Transparency: tell people when and how AI is used
What about automated decisions like AI credit scoring?
The Act gives people rights around decisions based solely on automated processing that significantly affect them. In practice, keep a human in the loop for important decisions, explain how decisions are reached, and give people a way to challenge them.
When do you need a Data Protection Impact Assessment (DPIA)?
A DPIA is required where processing is likely to result in high risk to people’s rights, for example large-scale profiling, sensitive data such as health information, or new technologies like AI. It documents the risks and the safeguards you will use.
Can you use cloud AI services hosted outside Kenya?
Transfers of personal data outside Kenya are allowed only with appropriate safeguards. Check where your AI provider stores and processes data, choose business plans that do not train on your data, and document the transfer in your data-protection records.
A practical AI compliance checklist
- Map what personal data each AI tool uses.
- Confirm your lawful basis and update privacy notices.
- Run a DPIA for high-risk uses.
- Choose AI vendors with strong data terms.
- Keep humans in the loop for significant decisions.
- Write an AI usage policy and train staff.
- Register with the ODPC if your organisation is required to.
Frequently asked questions
Do I need to register with the ODPC?
Many data controllers and processors in Kenya must register with the Office of the Data Protection Commissioner, depending on factors such as size and sector. Check the current registration regulations or ask an advocate.
Can staff paste customer data into ChatGPT?
Only if your policy and vendor terms allow it. Safer options are business AI plans that do not train on your data, removing personal details first, or private AI deployments.
Related services
AI Governance & Responsible AIUse AI with confidence: compliant, fair and secure.AI in Data GovernanceTrusted, compliant and well-managed data for AI.AI in BankingSmarter credit, fraud detection and 24/7 digital service.