Will AI Training Put Our Company Data at Risk?

No, not if the training is done well. The bigger risk is the one many companies already have: staff pasting company and customer data into AI tools with no rules. Good training lowers that risk, because it teaches the data rules before it shows the tools, and it runs on invented or masked material instead of your real files.

This page is for the HR or L&D manager, the head of department and the compliance or IT lead who has to answer one question before saying yes: "Will this make our data less safe?"

Is the worry fair?

Partly. A badly run session can create risk. If a trainer asks staff to upload real customer files to a free tool "to see what it can do", or shows exciting features with no rules attached, people leave keen to use AI more and with no idea where the line is.

So ask any provider, us included, exactly how data is handled in the room. The checklist below helps.

The risk you may already have

Your staff are probably using AI already. In October 2026, TechTrends Kenya reported a live poll of about 150 people at the Safaricom Cybersecurity Summit 2026:

• 42% said they knew unapproved AI was being used in their organisation.
• Another 25% said this was almost certainly happening.
• Only 6% said their organisation had a fully developed AI strategy and governance policy, reviewed and supported by staff training.

The report itself says the poll reflects the people at the event and is not a representative survey of Kenyan businesses. Read it as a signal. The report also notes that a staff member summarising a meeting may send names, financial details or internal plans to a service nobody has reviewed.

That is the real exposure. Training does not create it. Training is one of the ways to close it.

What Kenya's Data Protection Act expects

These points come from the Data Protection Act, 2019, as published by the Office of the Data Protection Commissioner (ODPC). This is a summary, not legal advice.

1. Use only what is needed. Section 25(d) says personal data must be limited to what is necessary for the purpose.
2. Think about where data goes. Section 25(h) says personal data should not be transferred outside Kenya without proof of adequate safeguards or the data subject's consent. Check where an AI tool stores what staff type.
3. Build in safeguards. Section 41 asks for technical and organisational measures, and lists pseudonymisation (replacing names and identifiers) among the measures to consider.
4. Make sure staff follow the rules. Section 42(4) says a controller or processor must take all reasonable steps to make sure the people working for it comply with the security measures.
5. Train the people who handle data. Section 24(7)(c) lists "capacity building of staff" among the duties of a data protection officer.
6. Report breaches fast. Under section 43, where personal data is accessed by an unauthorised person and there is a real risk of harm, the company must tell the Data Commissioner within 72 hours of becoming aware of it.

Put simply: the Act expects you to make sure staff follow your security rules. Teaching them those rules, with records of who attended, is a practical way to show you took reasonable steps.

For a fuller guide, read Can Staff Use ChatGPT Under Kenya's Data Protection Act?

How FuKazee handles data in training

Everything below is what our live pages say, as of November 2026.

• We don't need your real sensitive data. Our corporate AI training page says this in its answer to "Will our data be safe?"
• Invented or masked material. Our banking page describes exercises built on "an invented borrower, a fictional complaint, a sample circular". Our NGO page says training uses invented cases and sample documents, so staff learn "without ever pasting a real case record". Our Nairobi page says we train on masked examples.
• Data rules come first. Participants learn to sort information into what may go into a public AI tool, what may go only into an approved, controlled tool, and what must never leave your systems. Our NGO page says staff need to know this "before they are shown what the tool can do".
• A whole module on risk. Module 7, AI Ethics, Risk and Responsible Use, covers data leakage, hallucinations, bias, prompt injection and policy design. It helps leadership agree internal guardrails and clear rules for safe use, and an AI usage policy can be included if you need one.
• Work accounts before free accounts. Our Copilot training starts by finding out which Copilot your staff already have on their work accounts. Microsoft says Microsoft Copilot Chat (until recently called Microsoft 365 Copilot Chat) offers enterprise data protection at no extra cost, and that prompts and responses are not used to train the underlying models.
• Confidentiality in writing. Our vendor information page says that where an engagement involves your internal documents, a confidentiality agreement can be put in place first. Ask, and it will be reviewed.
• Private sessions too. For one-to-one training, we treat what you share as confidential and still ask you to mask client names, salaries and personal records, "because the safest data is data that never enters a tool".

Six questions to ask any AI trainer about data

1. Will our staff paste or upload any real company data during the session? If yes, which, and into which tool?
2. Are the exercises built on invented, masked or sample material?
3. Do you teach the data rules before you show the tools?
4. Which accounts will staff use: personal free accounts or our work accounts?
5. Will you sign a confidentiality agreement if you see our internal documents?
6. What do we keep afterwards: a usage policy draft, a data classification table, prompt libraries?

If a provider cannot answer these clearly, keep looking.

What this means for you

If your staff already use AI, skipping training leaves the risk unmanaged. The safer path is short: agree your data rules, teach them with safe material, then give people an approved tool.

You do not need a long programme to start. Any single module can run as a standalone workshop, so you can begin with the data and policy module alone. Pair it with our free AI acceptable use policy template and your staff leave with rules they can follow on Monday.

The one next step: ask us for the outline of Module 7 and the exact exercise material we would use with your team. You see it before anyone in your office opens a laptop.

Questions people ask

Do you need access to our systems or files?

Usually not. Exercises use invented, sample or masked material. Where you want sessions built around your internal documents, a confidentiality agreement can be put in place first, and we agree with you what is shared.

Should we just ban ChatGPT instead?

TechTrends Kenya's report warns that blanket bans can push staff towards tools outside approved systems. Clear rules, an approved tool and training usually work better.

Is it safe for staff to use free AI tools?

It depends on what they paste. Published information and general questions carry little risk. Customer records, payroll, board papers and anything under a confidentiality agreement should stay out of free public tools. Training teaches staff to tell the difference.

Will the training produce an AI policy for us?

An AI usage policy can be included if you need one, and Module 7 helps leadership work out governance and internal guardrails. Your lawyer and data protection officer should review any policy before you adopt it.

Can a FuKazee trainer see what our staff type?

The exercises run on invented or masked material, so there should be nothing sensitive to see. If you want sessions on your real documents, agree the rules and any confidentiality agreement with us first.

Is FuKazee NITA accredited?

Not yet. Ask us for the current status if NITA matters to your budget.

Sources

All sources last checked 14 November 2026.

• ODPC, Data Protection Act, No. 24 of 2019 (PDF): sections 2, 24(7)(c), 25(d), 25(h), 41, 42(4) and 43.
• TechTrends Kenya, "Shadow AI is exposing a governance gap inside businesses" (15 October 2026): the summit poll and the warning on bans.
• Microsoft Learn, Copilot Chat privacy and protections: enterprise data protection at no extra cost; prompts not used to train foundation models.
• FuKazee, Corporate AI training: the data answer, Module 7, usage policy, standalone modules.
• FuKazee, Microsoft Copilot training: finding which Copilot staff have first.
• FuKazee, AI training for banks and AI training for NGOs: synthetic exercises and classification before tools.
• FuKazee, AI training in Nairobi: masked examples.
• FuKazee, Vendor information: confidentiality agreements.
• FuKazee, One-to-one AI training: confidentiality and masking.

Where FuKazee fits in

FuKazee trains Kenyan teams to use AI on their daily work, with data rules taught first and exercises built on safe material. More than 3,000 people trained since 2022. Tell us your sector, team size and what worries you most about data, and we will send the outline. Email lead@fukazee.com