AI and the Data Protection Act: Staying on the Right Side of the ODPC
It was a Thursday afternoon and Halima in HR had a problem. She needed to analyse staff leave patterns for the quarterly report, and the spreadsheet was enormous. So she did what felt sensible: she copied the whole thing, names, ID numbers, phone numbers, medical leave notes and all, and pasted it into a free AI chatbot with the instruction "summarise this". It is exactly the kind of shortcut that makes anyone who understands AI and the Data Protection Act in Kenya quietly put down their tea.
The summary was excellent. The data protection situation, less so.
Halima is not careless, just busy. But Kenya's Data Protection Act 2019 has no exception for "I was in a hurry", and the Office of the Data Protection Commissioner (ODPC) does act on complaints. So here is how to get the benefits of AI without the headaches.
Personal data does not stop being personal in a chatbot
The Act protects personal data: any information that relates to an identified or identifiable person. Names, ID numbers, phone numbers, email addresses, location, and a great deal more. Some categories, such as health information, are treated as sensitive personal data and need extra care.
When you paste personal data into an AI tool, you are processing it, and possibly sharing it with a third party, the AI provider. All the usual principles still apply. You need a lawful basis for the processing, you should only use the data for the purpose it was collected for, and you should keep it secure.
The questions to ask before using any AI tool
Before your team uses an AI tool on anything involving people's information, someone should find answers to a few basic questions:
Does the provider store what we type in, and for how long?
Is our data used to train or improve their models?
Where in the world is the data processed and stored?
Can we delete our data, and how?
Is there a business agreement that sets out the provider's obligations?
Free consumer versions of AI tools often have weaker terms than paid business plans. That is not always the case, so read rather than assume. If nobody in the company can answer these questions, that is your answer for now: do not put personal data in.
Cross-border transfers are a real issue
Most popular AI services process data on servers outside Kenya. The Act has rules about transferring personal data out of the country, generally requiring appropriate safeguards for the data. Sensitive personal data comes with stricter conditions.
This does not ban international AI services. It means understanding where the data goes and whether the provider's protections suit the data involved. For health records or anything about children, be especially cautious and get proper legal advice.
Practical habits for AI and the Data Protection Act in Kenya
The good news is that most everyday AI use does not need personal data at all. A few simple habits cover a lot of ground:
Anonymise first: replace names and ID numbers with labels like Employee 1 or Customer A
Share the structure, not the data: ask the AI how to build a formula, then run it yourself in your own spreadsheet
Use approved tools only, ideally business plans with clear data terms
Never paste passwords, M-Pesa statements, payroll files or medical notes into a general chatbot
Keep a simple record of which AI tools are used for what
Halima could have asked the AI how to build a pivot table for leave patterns, then built it herself. Same result, no data leaving the building.
When AI makes decisions about people
Things get more serious when AI is used to make or heavily influence decisions about individuals. Screening job applicants, scoring loan applications, flagging employees for performance issues, or deciding which customers get which prices all fall into this category.
The Act gives people rights around automated decision-making that significantly affects them, and processing that is likely to result in high risk may call for a data protection impact assessment before you start. In plain terms: if a machine is deciding things about people, a human should be able to review the decision, people should be told, and you should have thought through the risks in writing.
The basics still apply too: organisations that meet the ODPC's criteria must register as data controllers or processors, and people can access and correct their data. AI does not remove any of that.
Make it someone's job
In many small businesses, data protection is everyone's responsibility, which means nobody's. Pick one person to own AI and data questions. They need not be a lawyer, just someone who keeps the approved tool list and knows when to call in professional help.
Then write it down in a short policy that people will actually read. One page is better than twenty. The aim is not to ban AI. It is to make sure that when Halima next needs a quick summary, she knows exactly how to get one without making anyone at the ODPC reach for their pen.
Your next step: list every AI tool your team used this month and check each one's data terms by Friday. For HR teams, keeping payroll and staff records inside a dedicated system like OfficeCUBE also means fewer spreadsheets wandering off into chatbots.