On this page
TL;DR:
- Kenya's Data Protection Act, 2019 covers NGOs. If your organisation decides why and how personal data is used, you are a data controller.
- Much of what NGOs hold is "sensitive personal data" under the Act: health, family details, ethnic origin, belief and more.
- Names, ID numbers, case notes, children's details, safeguarding reports and individual donor records should never go into a public AI tool.
- Removing the name is often not enough. Age, location and circumstances together can still point to one person.
- A one-page rule, an approved account, a cleaning habit and a clear breach plan prevent most problems.
Who this guide is for
This guide is for NGO directors, programme and M&E staff, fundraisers, safeguarding leads and anyone handling personal data in a Kenyan non-profit.
It is general information, and it is not legal advice. For a specific case, speak to your data protection officer or a lawyer.
Does the Data Protection Act apply to NGOs?
Yes. The Act defines a data controller as any person, public authority, agency or other body that decides the purpose and means of processing personal data. Nothing in that definition leaves out non-profits.
Registration has a small exemption with a catch. Under regulation 13 of the 2021 registration regulations, an organisation is exempt from mandatory registration only if it has annual turnover or revenue below KES 5 million and fewer than ten employees. The regulations name NGOs, charities, religious institutions and civil society organisations as non-profit bodies, and the ODPC's guidance measures their turnover by utilised annual budget.
The catch: the ODPC says organisations working in certain sectors must register whatever their size. Those sectors include education and health administration and provision of patient care. So a small NGO running a school feeding scheme or a clinic should check carefully.
Exempt organisations must still follow Part IV (principles and obligations) and Part VI (transfers out of Kenya) of the Act. Those are the parts that matter most when you use AI.
What NGOs hold, and how the law sees it
Most NGO records contain personal data, and many contain sensitive personal data. Section 2 of the Act lists sensitive data as information revealing race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (including names of children, parents and spouses), sex or sexual orientation.
| Record | Why it is high risk | Extra law to know |
|---|---|---|
| Beneficiary registration | Names, IDs, phone numbers, household make-up | Family details are sensitive |
| Health or HIV programme files | Health status | Section 46 limits who may process health data. Second Schedule lists HIV and mental disorder |
| Children's case files | Child's data and family circumstances | Section 33 needs parent or guardian consent and the child's best interests. Second Schedule covers a child in need of care and protection |
| Safeguarding and GBV reports | Abuse, identity, location | Second Schedule covers domestic, child and sexual abuse |
| Cash transfer lists | Names, phone numbers, amounts | Second Schedule covers payments of money to a person |
| Refugee or ethnic community records | Origin, belief, location | Ethnic social origin and belief are sensitive |
| Donor records | Names, contacts, giving history, payment details | Bank and card details are in the Second Schedule |
The Second Schedule to the General Regulations matters because of regulation 37. That regulation treats a breach as carrying a real risk of harm when a person's name or identification number is exposed together with items on that list. In plain terms, many ordinary NGO files would be notifiable if they leaked.
The exception that many NGOs misread
Section 45(a) allows some not-for-profit bodies to process sensitive data, but it is narrow. It covers a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim. The processing must relate only to members or people in regular contact with it, and the data must not be disclosed outside the body without consent.
Three points follow.
- Many development NGOs may not fit the description of those aims. Do not assume it covers you.
- Beneficiaries of a one-off programme may not be people in regular contact with the body.
- Sending someone's data to an outside AI company is hard to square with the condition about not disclosing it outside the body.
Have someone qualified check which ground in section 45 you rely on.
What happens legally when staff paste data into an AI tool
Pasting a beneficiary's details into a public chatbot can break several rules at once. Each problem below has a different fix.
No processor contract. Under section 42(2), when another party processes data for you, you need a written contract that binds it to your instructions. Regulation 24 lists what that contract must contain. A staff member using a personal account usually has no contract between the NGO and the provider.
Data leaves Kenya. Section 25(h) bars transfers without proof of adequate safeguards or the person's consent. Section 48 sets conditions for transfers. Section 49 goes further for sensitive data: it requires both consent and confirmation of appropriate safeguards. The ODPC published Guidance Notes for Cross-border Data Transfers on 8 September 2026, and Afriwise reports that they expect each transfer to be recorded with its date, time, recipient, justification and a description of the data.
More data than the task needs. Section 25(d) limits data to what is necessary. To draft a thank-you template, a tool needs no donor's name at all.
A new purpose nobody was told about. Section 25(c) limits use to the purposes for which data was collected. Section 29 requires you to tell people, before collection and as far as practicable, about the purpose and about third parties who will receive their data.
Consent is harder than it looks. Under section 32 you carry the burden of proving consent. Section 32(4) makes you look at whether a service is conditional on consent to something it does not need. In our view, a person who needs food or school fees is in a weak position to refuse. Do not make AI processing a condition of receiving help.
What AI providers say they do with your data
The same brand can treat data very differently depending on the account. This is what we could confirm on 9 November 2026. Settings change, so check again before you rely on it.
| Tool and account | What the provider says | What it means for you |
|---|---|---|
| Google Gemini Apps, personal account | With Keep Activity on, chats can be used to improve services, including training AI models. Some chats are read by human reviewers and may be kept for up to three years. With it off, chats are still kept for up to 72 hours, and reviewers may still look at them for limited purposes such as safety | Google asks users to keep confidential information out. Never use this for personal data |
| Claude, Free, Pro or Max | Chats may be used for training if you turn on the Model Improvement setting, or if flagged for safety review | Check the setting on each account. It is still a personal account with no NGO contract |
| Microsoft Copilot Chat or Copilot, signed in with a work account | Microsoft acts as data processor under its Data Protection Addendum, and prompts and responses are not used to train foundation models. Web searches are handled separately | Needs a qualifying Microsoft 365 plan and work sign-in. A personal Microsoft account does not count |
| ChatGPT | OpenAI's data-use pages did not open for us when we checked | We make no claim here. Read the data settings and terms for your own account |
Switching off training does not solve everything. It deals with one risk. You still have the contract, transfer and minimisation duties above.
Some offices run an open-source AI model on their own computer, so text stays in the building. It takes more effort and a decent machine. See our guide to running open-source AI models locally.
What must never go into a public AI tool
The simple test: if you would not pin it on the noticeboard at the community centre, keep it out.
| Function | Never paste | Only after careful cleaning | Safe to paste |
|---|---|---|---|
| Programmes | Beneficiary lists, household data, case notes | Activity summaries with no identifiers | Public programme descriptions |
| Health | Patient files, test results, HIV status | Totals for a large group | Published health guidance |
| Child protection | Any child's name, school, photo or case | A fully invented scenario for training | Published child protection standards |
| Safeguarding | Reports, names of survivors or accused, locations | Nothing from a real case | Your blank policy template, if not confidential |
| Cash transfers | Names, phone numbers, M-PESA records, amounts per person | Total disbursed by programme | Public eligibility rules |
| M&E | Raw survey data with identifiers, GPS points | Totals for groups that are not small | Your blank questionnaire |
| Fundraising | Individual donor names, contacts, gift history | Giving totals by year | A blank thank-you template |
| HR | CVs, pay, medical or disciplinary files | A job description with no candidate data | Interview question bank |
Safeguarding reports deserve a firm rule. Do not use a public AI tool for a live safeguarding case, even with names removed. The details are often unique enough to identify someone, and the harm from a mistake can be severe.
Why removing the name is not enough
Anonymisation in the Act means removing identifiers so that the person is no longer identifiable. If someone can still work out who it is, you have not anonymised it.
The UN's Centre for Humanitarian Data makes this point about survey data: even after names and phone numbers are removed, combining details such as location or ethnicity can still reveal who a respondent is.
Pseudonymisation is different. It replaces names with labels, and you keep the key separately and safely. It reduces risk, but the data can still be personal data because your office can link it back.
A worked example
This case is invented for training.
Before (do not paste):
Grace Njeri, 15, Form 2 at Shule X, Kibera. Guardian: her aunt, Mary Akinyi, 0700 000 000. Father died in June. Grace is HIV positive and missed 14 days of Term 2 for clinic visits. Fee arrears of KES 18,000. Bursary panel meets on 20 November.
After (safer):
Draft a blank template for a one-paragraph bursary case summary. It should have headings for: the student's education stage, family support, barriers to attendance in general terms, financial need, and the recommendation. Use square brackets for each detail. Keep the tone respectful, and avoid language that defines a young person by hardship.
The safest version here contains no case at all. The tool writes a template, and a staff member fills it in by hand inside your own system.
If you do need help with real content, reduce it first:
- Remove direct identifiers: names, ID, phone numbers, school and aunt.
- Remove indirect identifiers: age, class, exact days missed, exact arrears and dates.
- Remove sensitive details: HIV status and the death in the family. Ask whether the task truly needs them. Usually it does not.
- Keep the key apart: any link between "Student A" and the file stays in your case system.
- Fill in and check by hand, inside your own system.
A prompt to look for leftovers
Run this on text you have already cleaned. It is an extra check, and your own reading comes first.
I have removed personal details from the text below. Act as a privacy reviewer. List any remaining detail that could help someone identify a person or a small group, such as a rare job, exact age, small location, unusual event, date or family situation. Explain the risk of each in one line and suggest a more general wording. Do not guess who the person is. Text: [paste already-cleaned text]
Our small-numbers rule of thumb
Be careful with small groups in reports and in prompts. "Three widows in Ward C received grants" could identify all three. We suggest merging any group smaller than about ten with a wider category, and being stricter in conflict-affected or close-knit places. This is a practical rule of thumb, and it is not a figure from the Act. For large survey datasets, start with the Centre for Humanitarian Data's guidance.
Donor data needs its own rule
Donors trust you with names, contacts and sometimes payment details. A leak can bring a complaint and damage the relationship that funds your work.
Practical rules for a fundraising team:
- Write the thank-you template with AI, using [Name] and [Project]. Do the mail merge inside your own system.
- Do not paste a donor list to ask for segments. Give the tool columns with no names, or ask for an Excel formula.
- Do not ask a public tool to research or profile a named individual donor using what you hold about them.
Children, survivors and images
Extra care applies when the person is a child or at risk. Section 33 requires a parent or guardian's consent and processing that protects and advances the child's best interests.
Kenya's regulator has already enforced this, though in a case that had nothing to do with AI. In 2023 the ODPC fined Roma School KES 4.55 million after it posted pictures of minors without parental consent. A beneficiary photo in a donor report, a newsletter or an AI image tool raises the same kind of question.
Our position:
- Do not upload photos of beneficiaries to AI image or editing tools unless you have specific consent and an approved tool.
- Never create AI images that pretend to show real beneficiaries.
- Expect safety filters. Some tools refuse prompts about sexual violence even in training. Our guide on training NGO staff on AI explains how to prepare for this.
When AI helps choose who gets support
Section 35 gives people a right not to be subject to a decision based solely on automated processing that significantly affects them. There are narrow exceptions. Selecting beneficiaries, scoring bursary applicants or stopping a cash transfer can all significantly affect someone.
AI can help you summarise rules or organise anonymised information. A named person should make the decision, and the person affected should have a way to challenge it. Also watch for bias against people with less data, less mobile access or less formal language.
When you need a Data Protection Impact Assessment
A DPIA is required before processing likely to result in high risk (section 31). Regulation 49 treats these among the high-risk uses: sensitive personal data, data about children or vulnerable groups, combining datasets, large-scale processing, and innovative use of new technology. Many AI projects that touch beneficiary records will tick more than one.
Section 31(5) says the report goes in sixty days before processing. Plan for that before promising a donor an AI feature in your project.
You likely need a DPIA for:
- A chatbot that handles beneficiaries' questions and personal details.
- AI scoring or targeting of households.
- Uploading case records to any AI system, approved or not.
You are less likely to need one for drafting a newsletter with no personal data. Record your reasoning anyway.
The rules still being written
The ODPC published a draft Guidance Note on Artificial Intelligence, dated July 2026. Consultation closed on 17 August 2026, and Digital Policy Alert still lists it as a draft being processed. The PDF did not open for us on 9 November 2026, so what follows relies on published reports.
- PPC Land reports that the draft treats generative AI platforms as high risk, with a DPIA, DPO involvement, human review and regular audits.
- It also reports a middle tier where an assessment is expected unless a written analysis shows low risk. The examples include a generative chatbot with no personal data input and AI translation using anonymised inputs.
- Business Daily reports that the draft expects a written processing agreement with offshore AI vendors, a lawful transfer basis, and that the local organisation stays accountable.
The draft is not binding, but it shows how the regulator reads the Act. Separately, the Artificial Intelligence Bill, 2026 is a Bill and not law. In October 2026 a Senate committee recommended not proceeding with it. Our Kenya AI Bill 2026 explainer has more.
A one-page rule you can adapt
A short rule that people remember works better than a long policy nobody opens. Adapt this one with your legal adviser and safeguarding lead.
How we use AI at [Organisation]
- Approved tools: [list]. Use your work account only.
- Never enter names, ID or phone numbers, addresses, case notes, health details, children's details, safeguarding information, individual donor records, or payment details into a public AI tool.
- Before using AI on work text: remove identifiers, then ask, "Could someone guess who this is?" If yes or maybe, stop.
- Prefer templates with [brackets]. Fill in real details inside our own systems.
- Do not upload photos of people we serve.
- AI never decides who receives support. A named person does.
- A person checks every AI output before it is used.
- Live safeguarding cases never go into AI tools.
- Made a mistake? Tell [name, phone] the same day. You will not be punished for reporting quickly.
Rule 9 matters. If people fear punishment, they stay quiet, and the 72-hour clock runs out. For a fuller document, see our guide to an AI usage policy for Kenyan organisations.
What to do if someone already pasted personal data
Act the same day. Section 43 gives a controller 72 hours from becoming aware of a notifiable breach to tell the Data Commissioner.
- Stop and write it down: what was entered, into which tool and account, when and by whom.
- Tell your data protection lead the same day. Include the safeguarding lead if anyone at risk is involved.
- Contain it: delete the chat and uploads, and check the tool's history and settings. Deleting may not remove every copy, so record what the provider says.
- Assess the risk. Was data accessed or acquired by an unauthorised person, and is there a real risk of harm? Check regulation 37 and the Second Schedule. Take advice if unsure.
- Notify the ODPC within 72 hours if required, with reasons if you are late.
- Tell affected people in writing within a reasonable time if required. Think about how to do so safely.
- Tell your donor if your grant agreement requires it.
- Fix the cause: training, an approved tool or a clearer rule.
The maximum administrative fine under section 63 is KES 5 million or, for an undertaking, one per cent of the previous year's turnover, whichever is lower. For many NGOs, the larger cost would be harm to the people served and the loss of trust.
Checklist for an NGO director
- We have checked whether we must register with the ODPC.
- Someone is named as responsible for data protection.
- There is a written rule on AI tools, and staff know it.
- Any AI vendor that receives personal data has a written contract.
- Privacy notices and consent forms reflect what we actually do.
- We have considered a DPIA for AI that touches beneficiary data.
- Safeguarding and data protection leads have agreed the rule.
- Staff know how to report a mistake on the same day.
Questions people ask
Do small NGOs have to follow the Data Protection Act?
Yes. Some small organisations are exempt from registering, but even they must follow the principles in Part IV and the transfer rules in Part VI. NGOs in education or health should check the registration rules closely, because the ODPC lists those sectors as having no exemption.
Can we use ChatGPT if we remove the beneficiary's name?
Removing the name alone is often not enough. Age, location, family situation and unusual events can still identify someone. Remove those too, or better, ask for a blank template and fill it in yourself.
Does turning off AI training make it compliant?
It reduces one risk. You still need a lawful basis, data minimisation, security, a contract with any processor and a lawful way of transferring data abroad. Keep personal data out unless those are in place.
Do we need beneficiaries' consent to use AI on their data?
Consent is one lawful basis under section 30, and others exist. Section 49 requires consent for sensitive data processed outside Kenya, along with confirmed safeguards. Consent must be real, so do not tie help to agreeing.
Can we use AI to analyse survey data?
Yes, after proper cleaning, using totals for groups that are not small. Raw survey data with identifiers or GPS points should stay out of public tools.
Sources
- The Data Protection Act, No. 24 of 2019 (ODPC copy of the Gazette version), last checked 9 November 2026
- The Data Protection (General) Regulations, 2021 (ODPC), last checked 9 November 2026
- The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (ODPC), last checked 9 November 2026
- ODPC, Guidance Note on Registration of Data Controllers and Data Processors, last checked 9 November 2026
- Digital Policy Alert, Guidance Note on Artificial Intelligence (status: draft), last checked 9 November 2026
- PPC Land, report on the ODPC draft AI guidance, last checked 9 November 2026
- Business Daily, Regulator now plans tighter data shields on offshore AI platforms (4 August 2026), last checked 9 November 2026
- Afriwise, What Kenya's new cross-border data transfer guidance means for businesses (28 October 2026), last checked 9 November 2026
- The Star, School fined Sh4.5m for using minors' pictures without parental consent (26 September 2023), last checked 9 November 2026
- The Star, Senate committee shoots down Nyamu's Bill on AI (15 October 2026), last checked 9 November 2026
- Centre for Humanitarian Data (OCHA), Guidance Note on Statistical Disclosure Control, last checked 9 November 2026
- Google, Gemini Apps Privacy Hub, last checked 9 November 2026
- Anthropic, consumer plans: Is my data used for model training?, last checked 9 November 2026
- Microsoft Learn, Enterprise data protection in Microsoft Copilot and Copilot Chat, last checked 9 November 2026
- Microsoft Support, Get started with Microsoft Copilot, last checked 9 November 2026
Where FuKazee fits in
Data handling comes first in the NGO training we run, before anyone opens a tool. Teams agree their red lines and practise on invented or cleaned material, so no beneficiary data enters the room. We assume nobody knows AI yet, avoid jargon and show the free version of each feature, along with what that version does with your data.
We can teach safe habits and help your team draft its working rule. We do not replace your lawyer or data protection officer, and training cannot make a risky system compliant.
Read how to train NGO staff on AI in Kenya, or see the full programme on our page for AI training for NGOs in Kenya.
To talk through training for your team, email lead@fukazee.com
Want guided support instead?
Not sure which programme fits? Tell us who you are and we will point you to the right path: corporate AI training, the ScholarShift Accelerator for postgraduates, or KCSE study plans and tuition.
Rodney has run FuKazee's training since 2022 and still teaches inside every programme line: corporate sessions, the postgraduate cohort and the KCSE examiner webinars. First Class Honours in Journalism and Mass Communication, University of Nairobi.
