Using AI Safely: Kenya's Data Protection Act

AI tools are safe to use at work when you know what not to put in them. In Kenya, the rules on personal data come from the Data Protection Act, 2019, regulated by the Office of the Data Protection Commissioner (ODPC).

This lesson is practical guidance, not legal advice. For decisions about your organisation’s obligations, check the ODPC’s official guidance at odpc.go.ke or speak to a lawyer.

What counts as personal data

Personal data is any information that identifies a living person: names, phone numbers, ID numbers, email addresses, M-Pesa transaction details, photos, location. The Act gives extra protection to sensitive personal data, which includes health information, biometric data, ethnic origin, and details about a person’s family and children, among other categories.

Why AI tools need care

When you paste text into an AI chat, it is sent to the provider’s servers, usually outside Kenya. Depending on your plan and settings, it may be stored and, on some consumer plans, used to improve the model. If that text contains clients’ or staff members’ personal data, you are processing and sharing their data, and the Act’s principles apply: data must be used for a lawful, specific purpose, kept to what is necessary, and kept secure.

The Act allows significant administrative penalties: the Data Protection Commissioner can fine up to five million shillings, or one percent of annual turnover for a business, whichever is lower. The bigger cost for most businesses is the loss of client trust.

Five rules for using AI at work

1. Strip identities first. Replace names, phone numbers and ID numbers with codes such as Client A or 07XX before pasting. The AI rarely needs to know who the person is.
2. Never paste sensitive data into a free tool. Health records, children’s details, payroll and ID copies stay out, full stop.
3. Use a business plan for company work. Business plans generally commit the provider not to train on your data and give admin controls. Read the terms to confirm.
4. Check before you share AI output. You are responsible for what you send, whoever drafted it.
5. Know who to ask. Name one person in your organisation who decides which tools are approved and answers questions.

A one-paragraph team policy

You can adopt this today and improve it later:

“Staff may use approved AI tools (list them) to draft, summarise and edit work. Staff must not paste personal data about clients, patients, students or staff into any AI tool unless the tool is approved for that purpose. All AI output must be checked by the staff member before it is sent or used. Questions go to (name).”

If your business handles a lot of personal data

Hospitals, schools, SACCOs, lenders and law firms carry more risk. Our article on what Kenya’s DPA 2019 requires of patient management systems shows how the same principles apply to the systems that store that data.

Key takeaways

• Personal data in Kenya is protected by the Data Protection Act, 2019, regulated by the ODPC.
• Text you paste into an AI chat is sent to the provider, so strip names, phone numbers and ID numbers first.
• Health records, children’s details, payroll and ID copies never go into a free AI tool.
• A one-paragraph AI policy naming approved tools and one contact person is a good start for any team.