Free resource

AI Governance and Data Protection Checklist for Kenyan Businesses

A practical checklist for using AI responsibly and in line with Kenya's Data Protection Act 2019. Work through each section to see where you already comply, and where you have gaps to close before you scale up your AI use.

How to use this: tick items as you confirm them. The boxes are just for your own tracking on this page and reset when you reload.

Save a copy: use your browser Print option and choose "Save as PDF" to keep this checklist or share it with your team.

This is a practical checklist, not legal advice. For anything specific to your business, confirm the details with a qualified data protection advocate or advisor.

Last updated: 18 September 2026

1 Get the data protection basics in place

Kenya's Data Protection Act 2019 applies to most businesses that handle customer information. Start with the foundations.

Confirm whether your business needs to register with the Office of the Data Protection Commissioner (ODPC).
Write down every place you collect personal data (forms, WhatsApp, POS, CCTV, loyalty sign-ups).
Name one person who is responsible for data protection in your business.
Have a clear, plain-language privacy notice that tells people what you collect and why.
Keep a simple record of what personal data you hold and where it is stored.

2 Confirm a lawful basis and get real consent

You need a valid reason to use someone's data, and consent has to be genuine, not buried in small print.

For each use of personal data, note your lawful basis (consent, contract, legal duty, and so on).
Make consent a clear opt-in, never a pre-ticked box or an assumed yes.
Tell people before you feed their data into an AI tool, not after.
Give an easy way to withdraw consent and honour it promptly.
Keep a record of when and how each person gave consent.

3 Collect and keep only what you need

Data minimisation is a core principle of the Act. Less data means less risk and less to secure.

Collect only the fields the task actually requires.
Avoid pasting sensitive personal data into AI tools unless it is truly necessary.
Set a retention period for each type of record and delete data once it is no longer needed.
Anonymise or remove names and ID numbers when the detail is not required.
Review old spreadsheets and chat exports for personal data you no longer need.

4 Know where your AI tools send data

Many AI tools process data on servers outside Kenya. You are responsible for knowing where your customers' data goes.

List every AI tool your team uses and what data each one receives.
Check each tool's terms for where data is stored and whether it is used to train models.
Understand the Act's rules on transferring personal data outside Kenya before you do it.
Prefer tools that let you turn off training on your data or keep it private.
Never paste customer records, ID numbers, or medical details into a free public chatbot.

5 Keep a human in charge of decisions

AI should support your team, not replace their judgement on decisions that affect people.

Have a person review AI output before it reaches a customer or drives a decision.
Do not let AI alone make decisions with a significant effect on someone (credit, hiring, penalties).
Give customers a clear way to reach a human and question a decision.
Tell people when they are talking to an automated system rather than a person.
Define which decisions AI can assist with and which must stay fully human.

6 Check for accuracy and bias

AI can be confidently wrong and can repeat unfair patterns. Treat its output as a draft, not a fact.

Verify AI-generated facts, figures, and quotes before you act on or publish them.
Watch for output that treats groups of people unfairly and correct the process if it does.
Keep the training or reference data behind any AI tool as accurate and current as you can.
Test AI outputs on real examples before you rely on them at scale.
Give staff a simple way to flag wrong or unfair AI results.

7 Secure the data you hold

The Act requires you to protect personal data. Basic security stops most everyday incidents.

Use strong, unique passwords and turn on two-factor authentication on key accounts.
Limit access so staff only see the data their role actually needs.
Keep software, devices, and the website updated and patched.
Back up important data and confirm you can restore it.
Have a plan for what to do if data is lost, leaked, or stolen, including notifying the ODPC where required.

8 Review vendors and tools before you commit

When you use an outside tool or vendor, their handling of data becomes your responsibility too.

Ask each vendor how they store, secure, and use the data you share.
Check that any processor you use will handle data in line with the Act.
Put data handling terms in writing with vendors that process personal data for you.
Prefer tools with a clear privacy policy and a named contact for data questions.
Re-check your main tools periodically, since their terms and features change.

9 Write a short AI use policy

A one-page policy removes guesswork and protects the business. It does not need to be long to be useful.

State which AI tools are approved and which are off-limits.
Spell out what data must never be entered into an AI tool.
Set the rule that AI output is checked by a person before use.
Explain how customers are told when AI is involved.
Name who to ask when staff are unsure, and review the policy as tools change.

10 Build staff awareness

Most data incidents come from everyday habits, not hackers. A short briefing goes a long way.

Walk the team through the AI use policy and answer their questions.
Train staff to recognise personal and sensitive data and handle it with care.
Show real examples of what should and should not go into an AI tool.
Make it safe and simple to report a mistake early.
Refresh the briefing when you add a new tool or the rules change.

Not sure where you stand?

If you want a second pair of eyes on how your business handles data and AI, send us a message. We will help you spot the gaps that matter most and where to start.

Talk to us on WhatsApp