Data Protection and AI in Kenya's Public Sector: What the Law Requires of Ministries and Counties

TL;DR:

• Yes, a public body can use AI with citizens' data, on the same terms as any other processing under the Data Protection Act, 2019. Your institution is the data controller and carries the responsibility.
• Pasting a citizen's file into a free, public AI chat tool usually breaks several rules at once: no written processor contract (section 42), data leaving Kenya without documented safeguards (sections 25(h), 48 and 49), and more data than the task needs (section 25(d)).
• Health, biometric, family and property details are "sensitive personal data". Hospitals, registries, lands and social protection offices hold a lot of it, so AI projects there usually need a Data Protection Impact Assessment (section 31).
• If AI approves, refuses or scores citizens, section 35 protects them from decisions based solely on automated processing. Keep a person with authority in the loop.
• The ODPC's 2026 Guidance Note on AI and the national AI policy are drafts. The Act and its 2021 Regulations are the binding rules today.

The short answer for a busy officer

The Data Protection Act, 2019 applies to every ministry, state department, state corporation and county government that handles personal data. Its definition of a "data controller" names a "public authority, agency or other body" alongside companies.

Section 51 allows some exemptions, such as national security. But section 51(1) says no exemption removes the principles of lawful processing, minimisation of collection, data quality and security safeguards. Those are the principles AI use tests.

So the working question for a public office is how to use AI with citizens' data lawfully. For the wider picture of where AI helps government work, start with our pillar guide on AI in the public sector in Kenya.

Your institution is the data controller

Under section 2, a data controller decides the purpose and means of processing. A data processor processes data on the controller's behalf. If a county health department uses an AI tool to summarise patient complaints, the department is the controller and the AI company is usually a processor. The officer typing acts for the institution, and the institution answers for the result.

Registration. Section 18 says nobody may act as a controller or processor unless registered with the Data Commissioner. Regulation 6 of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 sets the rule for government:

• A state department or county department registers on behalf of the public entities under it that are wholly funded from the Consolidated Fund and provide a public service.
• A State Corporation or County Corporation registers on its own.

In June 2026 the ODPC publicly reminded organisations, including government agencies, that registration is mandatory. If a new AI system changes what you process, section 19(5) requires you to notify the Commissioner.

Lawful basis. Most public bodies rely on section 30(1)(b), which allows processing necessary for a task in the public interest or in the exercise of official authority. The ODPC's draft Guidance Note on AI gives AI-driven benefits eligibility assessment and AI-based land records management as examples, and adds that public bodies must still meet every other principle, including transparency and DPIAs. Section 30(2) also limits further processing to the purpose of collection.

Data protection officer. Section 24(1)(a) allows a DPO where processing is carried out by a public body, and section 24(4) lets one DPO serve several public bodies. Bring them in before any AI pilot that touches citizen records.

When an AI vendor becomes your processor

When your institution sends citizens' data to an AI service, section 42(2) requires you to choose a processor that gives sufficient guarantees on security, and to sign a written contract under which it acts only on your instructions. Under section 42(3), a processor that goes beyond your instructions is treated as a controller for that processing.

Regulation 24 of the Data Protection (General) Regulations, 2021 lists what the contract must contain. Turn each item into a question for the vendor:

Regulation 25 bars the processor from using a sub-processor without your prior authorisation.

The practical catch: when an officer uses a personal account on a free, public AI tool, there is usually no contract between the institution and the provider at all. That alone makes the processing hard to defend.

The principles that bite when AI is used

Section 41(4)(c) names pseudonymisation and encryption among the measures controllers should consider. That is your legal basis for cleaning documents before using AI, shown step by step below.

Sensitive personal data: why citizen records are high risk

Section 2 defines sensitive personal data as data revealing a person's race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (including names of children, parents and spouses), sex or sexual orientation.

Read that list with a public office in mind:

• Hospitals and health insurance schemes hold health status in almost every record. Section 46 limits health data processing to health care providers or people under a legal duty of professional secrecy.
• Registration and ID services hold fingerprints, facial images and family details.
• Lands registries hold property details.
• Social protection programmes hold family, disability and health details, often about children and older people.

Section 33 adds conditions for children's data. Section 49(1) says sensitive data may only be processed outside Kenya with the person's consent and confirmed safeguards. Regulation 49 lists high-risk processing that needs a DPIA, including sensitive data, biometric data, data on children or vulnerable groups, and "innovative use or application of new technological or organisational solutions". An AI project on registry or health data will usually tick several of these.

Cloud AI tools and data leaving Kenya

Many popular AI tools run on servers outside Kenya, and the ODPC's draft AI guidance notes that AI services are frequently provided by offshore processors. The rules:

• Section 48 allows transfer out of Kenya where you have given the Data Commissioner proof of appropriate safeguards, or where the transfer is necessary for listed reasons, including any matter of public interest.
• Regulation 40 requires the transfer to rest on safeguards, an adequacy decision, necessity or consent.
• Regulation 41(2) requires transfers relying on safeguards to be documented: date and time, recipient, justification and a description of the data.

Some public data must stay in Kenya. Under section 50, regulation 26 covers processing for civil registration and legal identity, elections, any state organ's public finance system, protected computer systems, early childhood and basic education, and primary or secondary health care. That data must be processed through a server and data centre in Kenya, or at least one serving copy must be kept in a Kenyan data centre. Registry, finance, education and health units should check this before any cloud AI pilot.

One lower-risk route is running an AI model on your institution's own computers, so documents never leave the building. See our guide to running open-source AI models locally.

Automated decisions: approvals, eligibility, revenue and recruitment

Section 35(1) gives every person "a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning or significantly affects the data subject."

Exceptions in section 35(2) cover decisions necessary for a contract, decisions authorised by a law with suitable safeguards, and decisions based on consent. Where a solely automated decision is taken, section 35(3) requires you to tell the person in writing, and they may ask you to reconsider or to take a new decision with human involvement.

Regulation 22 adds duties: inform people, explain the logic involved, prevent errors, eliminate discriminatory effects and bias, and make sure people can get human intervention. The draft Guidance Note on AI names "access to public services" among decisions that should not be made solely by automated means without meaningful human involvement.

In practice:

• Permits and approvals: AI can sort and summarise; a named officer decides.
• Bursaries, cash transfers and waivers: AI scoring can guide, but a reviewer must be able to overrule it.
• Revenue: an AI audit flag leads to human review before any demand or penalty.
• Recruitment: the draft guidance treats AI screening of candidates as high risk. Tell applicants and keep human review of hiring decisions.

An officer who approves every AI recommendation without reading the file is unlikely to count as meaningful human involvement. Give reviewers the time, information and authority to disagree.

Data Protection Impact Assessments

Section 31(1) requires a DPIA before processing likely to result in high risk to people's rights. Under regulation 49 that includes automated decisions with significant effects, large-scale processing, combining datasets from different sources, and sensitive or biometric data.

Courts enforce this. In October 2021 the High Court (Justice Jairus Ngaah), in a case brought by the Katiba Institute, ordered the government to carry out a DPIA under section 31 for the Huduma Namba rollout.

A simple DPIA, following section 31(2):

1. Describe the AI tool, the data, whose data, the purpose and the lawful basis.
2. Test necessity: could the job be done with less data, or anonymised data?
3. List risks to citizens: leaks, wrong outputs, bias, data sent abroad, no way to challenge a decision.
4. List safeguards: contract, pseudonymisation, access control, human review, retention limits, training.
5. Decide if high risk remains. If it does, section 31(3) requires you to consult the Data Commissioner first.
6. Submit and record. Section 31(5) says reports are submitted sixty days before processing. Under regulation 52(3), if you hear nothing within sixty days you may proceed.

Regulation 50 offers a template in the Third Schedule. Your DPO should lead.

The 2026 picture: guidance, policy and a proposed bill

ODPC draft Guidance Note on Artificial Intelligence (July 2026). This is draft regulatory guidance, not law. Consultation opened on 1 August 2026 and closed on 17 August 2026, and at the time of writing we could not find a final version. It applies to public and private bodies that develop, deploy or procure AI. It lists high-risk uses that need a DPIA, DPO involvement, human review and regular algorithmic audit, and sets a pre-processing checklist, an AI governance framework and rules for generative AI. It also lists expected complaint types, such as undisclosed AI processing and unlawful transfers to an AI processor abroad.

Kenya Artificial Intelligence and Other Emerging Technologies Policy, 2026. The State Department for ICT and the Digital Economy published this as a draft in July 2026, with comments due by 4 August 2026. A policy guides government action and creates no offences. For public bodies it proposes AI adoption regulations for all ministries, agencies, state corporations and counties; impact assessments before high-risk AI is used in benefits, permits, employment, health, taxation and similar decisions; vendor disclosure clauses in procurement; a public register of government AI systems; and human review, appeal and redress where AI decisions significantly affect people.

The Artificial Intelligence Bill, 2026 (Senate Bills No. 4 of 2026). A proposal, not law. In mid-October 2026 the Senate ICT committee recommended that the Senate not proceed with it, as reported by The Star and Techweez; the full Senate has not yet voted. We cover it in the Kenya AI Bill 2026, explained.

The ODPC's Guidance Notes for the Public Sector (2025) are also worth keeping beside the Act. They cover lawful bases for public bodies, data sharing, localisation and DPOs.

What can go into an AI tool?

This table assumes a general AI tool your institution has not assessed or contracted. With an approved tool, a processor contract and a DPIA, the middle column can widen.

When in doubt, treat it as "never" and ask your DPO.

How to anonymise or pseudonymise before using AI

Section 2 defines anonymisation as removing identifiers so the person is no longer identifiable. Pseudonymisation replaces identifiers so the data cannot be linked to a person without extra information, which you keep separately and protect. Pseudonymised text can still be personal data, because your office holds the key. The draft AI guidance also warns that "anonymised" data can sometimes be re-identified by linking it with other information.

Worked example (hypothetical)

An invented case for training. A social protection officer wants help drafting a reply.

Before (do not paste):

Complaint from Mary Achieng Otieno, ID No. 00000000, phone 0700 000 000, of Kamukunji Village, Ward X. She is 71, lives with a disability and cares for two grandchildren, Brian and Amani. Her cash transfer stopped in March after her husband, John Otieno, died. She says the chief has not signed her form.

After (safer to paste):

Complaint from Beneficiary A. Payments stopped after the death of the registered household member. The beneficiary cares for dependants. A local administration form is unsigned. Draft a polite reply explaining the replacement process, and a three-line note to the head of department.

What changed:

1. Direct identifiers removed: names, ID and phone numbers.
2. Indirect identifiers removed: village, age, disability and month. In a small ward, those together could point to one person.
3. Sensitive data removed: disability and family details are sensitive personal data.
4. Key kept separately: "Beneficiary A = case file reference" goes in the office case register, never in the AI tool.
5. Output checked by hand: the officer adds details back on the office system after checking the draft for errors.

Last check before pasting: could a colleague guess who this is?

A one-page checklist for a department head

• We are registered with the ODPC, directly or through our state or county department.
• Staff know who our DPO is.
• We have a written rule on which AI tools staff may use for official work.
• Nobody uses personal AI accounts for files with citizens' data.
• Every AI vendor receiving personal data has a contract meeting regulation 24.
• We know where each tool stores data, and we have checked regulation 26 for our sector.
• Transfers abroad are documented (regulation 41(2)).
• A DPIA is done for AI use involving sensitive data, automated decisions or large datasets.
• Our privacy notice tells citizens when AI is used.
• No AI system decides on a citizen without a named officer who can overrule it.
• AI outputs are checked before they enter records or letters.
• Staff are trained to anonymise before using AI, and to report mistakes within hours.

What to do if someone already pasted citizens' data

1. Stop and record what was entered, into which tool, when and by whom.
2. Tell the DPO the same day. Section 43(1)(a) gives the controller seventy-two hours from becoming aware of a notifiable breach to notify the Data Commissioner.
3. Contain it. Delete the chat and uploads and check the tool's history settings. If you have a contract with the vendor, ask in writing for deletion and confirmation.
4. Assess the risk of harm. Regulation 37 treats a breach as carrying real risk of harm where it involves a person's full name or identification number together with data in the Second Schedule, such as salary, bank account numbers, debts, certain health conditions, children in need of care and protection, or abuse. The DPO decides if it is notifiable.
5. Notify the ODPC if required, within seventy-two hours, with reasons if late (section 43(2)). Regulation 38 lists what the notice must contain.
6. Tell affected citizens in writing within a reasonably practical period where required (section 43(1)(b)), with the details in section 43(5).
7. Record the facts, effects and remedial action (section 43(8)), even if the breach is not notifiable.
8. Fix the cause: training, an approved tool, a clearer rule.

If the breach happens at your processor, section 43(3) requires it to tell you without delay and, where practicable, within forty-eight hours.

Enforcement: what the ODPC can do

• Administrative fines (section 63): up to five million shillings or, for an undertaking, one per cent of the previous year's annual turnover, whichever is lower. Under section 62(2) the Commissioner weighs, among other things, gravity, negligence, the categories of data, whether you self-reported and how well you cooperated.
• Offences (sections 72 and 73): unlawful disclosure of personal data is an offence. Where no specific penalty applies, conviction carries a fine of up to three million shillings, up to ten years' imprisonment, or both.
• Compensation (section 65) for people who suffer damage, and appeal to the High Court (section 64).

Real cases so far, none of them about AI:

• Oppo Kenya (December 2022): the ODPC's first penalty notice, KES 5,000,000, after the company ignored an enforcement notice over a photo used without consent.
• St. Luke's Orthopaedic and Trauma Hospital, Eldoret (reported April 2026): ordered to pay KSh 525,000 after a patient was twice given another patient's results. The Commissioner rejected a "human error" defence.
• Huduma Namba (October 2021): the High Court ordered a section 31 DPIA for the rollout.

Frequently asked questions

Is it illegal for a public officer to use an AI chat tool at work?

No law bans AI tools. The risk starts when personal data goes in without a lawful basis, a processor contract, transfer safeguards or minimisation.

Does a ministry or county need citizens' consent to use AI on their data?

Usually not. Section 30(1)(b) covers public tasks and official authority. Consent matters in specific cases, such as sending sensitive data outside Kenya (section 49(1)).

Is a county government a data controller?

Yes. The definition includes a public authority or agency. County departments register for their entities; county corporations register on their own.

Can AI decide who gets a bursary, permit or cash transfer?

AI can sort and summarise. Section 35 protects people from significant decisions based solely on automated processing, so keep a named officer who reviews and decides.

Is the ODPC Guidance Note on AI binding?

It is a draft. Consultation closed on 17 August 2026. It shows how the regulator reads the Act, which is binding now.

If our AI tool is hosted in Kenya, are we compliant?

Local hosting helps with transfer rules and regulation 26. You still need a lawful basis, a contract, minimisation, security, a DPIA where risk is high, and human review.

Where FuKazee fits in

FuKazee builds data handling into every AI training we run. We assume nobody in the room knows AI yet, and we show the free version of every tool, so officers learn what each one does with their data before using it on real work. Since 2022 we have trained more than 3,000 people across Kenya.

For ministries, state agencies and counties, we teach officers to draft, summarise and analyse with AI while keeping citizens' data safe. See our AI training for government in Kenya.

To plan training for your department, email lead@fukazee.com

This article is general information, not legal advice. Check with your data protection officer or the ODPC before acting.

Sources

• The Data Protection Act, No. 24 of 2019 (official Gazette copy, ODPC)
• The Data Protection (General) Regulations, 2021 (ODPC)
• The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (ODPC)
• ODPC Guidance Note on Registration of Data Controllers and Data Processors
• ODPC Guidance Notes for Public Sector (2025)
• ODPC Guidance Note on Artificial Intelligence, July 2026 (draft)
• Digital Policy Alert, ODPC closes consultation on draft Guidance Note on AI
• Kenya Artificial Intelligence and Other Emerging Technologies Policy, 2026 (draft)
• Eastleigh Voice, Kenya opens draft AI policy for public consultation until August 4
• Senate Bill Digest, The Artificial Intelligence Bill, 2026
• The Star, Senate committee shoots down Nyamu's Bill on AI (15 October 2026)
• Techweez, Kenya AI Bill 2026 rejected
• ODPC, Penalty Notice against Oppo Kenya
• HapaKenya, St. Luke Hospital fined Ksh. 525,000 by ODPC over medical record mix-up
• The Star, High Court declares Huduma Namba process illegal
• Kenyans.co.ke, ODPC directs entities handling people's data to register