On this page
TL;DR:
- Yes, staff at a Kenyan private company can use AI tools at work. The Data Protection Act, 2019 applies to any personal data they put in, and the company answers for it.
- The biggest risk is a staff member pasting customer or staff details into a free personal account. That usually means no vendor contract (section 42), no proof of safeguards for data leaving Kenya (sections 48 and 49) and more data than the job needs (section 25).
- The fix can cost little: give staff an approved work account, a short written rule, and practice at removing names and numbers before they paste.
- HR needs the most care. Screening CVs or monitoring productivity with AI is high risk in the regulator's draft guidance, and section 35 protects people from decisions made only by a machine.
- As of November 2026, Kenya has no AI law in force. The Act and its 2021 Regulations are the binding rules. The regulator's AI guidance is still a draft.
Who this guide is for
This guide is for private employers in Kenya: company directors, HR managers, compliance officers, operations leads and data protection officers. It fits a 15-person firm and a large group.
If you work in a ministry, county or state agency, read our separate guide on data protection and AI in Kenya's public sector. The legal basis for your work is different.
The short answer: AI tools are allowed, and the Act still applies
No Kenyan law bans staff from using ChatGPT, Copilot, Gemini or Claude. The Act applies whichever app the data passes through. Under section 2, "personal data" means any information relating to an identified or identifiable person. A name typed into a chat box is still personal data.
Your company is almost always the data controller, because it decides why and how the data is used. The staff member who typed the prompt acts for the company. So a mistake by one employee becomes the company's problem.
Section 42(4) makes this direct. A controller must take all reasonable steps to make sure that anyone it employs complies with the security measures. If your staff have never been told what they may paste into an AI tool, that duty is hard to show.
There is a personal side too. Section 72(3) makes it an offence to disclose personal data to a third party. Section 72(4) protects an employee or agent acting within the scope of their mandate. A clear written rule tells staff where that scope lies, so it protects them as well as the company.
Does a small company have to care?
Yes. The exemption from registration is narrow, and it does not remove the main duties.
Regulation 13 of the Registration Regulations, 2021 exempts a company from mandatory registration only if it has both a turnover below KES 5 million and fewer than ten employees. Even then, regulation 13(3) says it must still comply with Part IV of the Act (the principles and duties) and Part VI (data leaving Kenya).
The Third Schedule also lists sectors that must register. They include educational institutions, health care, hospitality firms, property management, financial services, telecoms, businesses mainly in direct marketing, and transport services.
Four questions to ask about any staff use of AI
Before a team uses AI on anything with personal data, answer these four questions in writing.
1. What is our lawful basis?
Section 30 says you may not process personal data without a lawful basis. Regulation 5 adds that you must set the basis before you start, and be able to show it at all times.
| Task at a private company | Likely basis | Watch out for |
|---|---|---|
| Drafting a reply to a customer's own complaint | Contract, section 30(1)(b)(i) | The tool only needs the issue, so leave out the ID and phone number |
| Personalising marketing with a customer list | Express consent, section 37; regulation 15 | Every message needs a free way to opt out (regulations 15 and 16) |
| Summarising staff appraisals | Legitimate interests, section 30(1)(b)(vii) | Fails if the use is unwarranted given the harm to the employee |
| Reading health details in an insurance or medical claim | Often explicit consent; take advice | In the St. Luke's case the Commissioner ruled that legitimate interest could not justify processing sensitive health data |
| Using old customer chats to build your own bot | A new basis and a fresh look | Section 30(2) limits further use to the purpose of collection |
2. Is the AI company bound by a contract with us?
When a vendor processes personal data for you, section 42(2) requires two things. You must choose a vendor with sufficient guarantees about its data protection measures. You must also sign a written contract that says it acts only on your instructions.
Regulation 24 lists what that contract must cover: the subject and purpose, the type of data, your instructions, staff confidentiality, security, deletion or return of data, and your right to audit. Regulation 25 bars sub-processors without your prior approval.
A staff member's free personal account usually has no contract with your company at all. That alone makes the use hard to defend.
3. Does the data leave Kenya, and can we justify it?
Most popular AI tools run on servers abroad. Section 25(h) says personal data must not leave Kenya without proof of adequate safeguards or the person's consent. Section 48 sets the conditions. Regulation 40 requires the transfer to rest on safeguards, an adequacy decision, necessity or consent. Where you rely on safeguards, regulation 41(2) requires a record of the date and time, the recipient, the reason and a description of the data.
Section 49(1) is stricter. Sensitive personal data may be processed outside Kenya only with the person's consent and confirmation of safeguards. Sensitive data includes health status, biometric data, property details, marital status, and family details such as the names of children and spouses.
If you run a school or a clinic, read regulation 26 before any cloud AI pilot. For early childhood and basic education, and for primary or secondary health care, it requires processing through a server and data centre in Kenya, or at least one serving copy in a Kenyan data centre. Ask your lawyer how it applies to you.
4. Are we using more data than the job needs?
Section 25(d) requires data to be limited to what is necessary. Section 41(3) requires this by default. To improve the wording of a reply, the tool needs the problem. It does not need the customer's name.
Free accounts and work accounts are different
The same brand of tool can carry very different terms depending on how you sign in. Here is what each provider's own pages said when we checked on 9 November 2026. These terms change, so check them again before you decide.
| Tool and account | What the provider says | What it means for an employer |
|---|---|---|
| Microsoft Copilot Chat, signed in with a work account | Enterprise data protection applies at no extra cost. Prompts and responses are not used to train foundation models. Microsoft acts as a data processor. | A strong starting point if you already use Microsoft 365. Prompts are logged and your IT admin can review them, so tell staff. |
| Gemini app, personal Google account | A subset of chats is reviewed by people. Reviewed chats are kept for up to three years. Google asks you not to enter confidential information. | Do not use it for personal data at work. |
| Gemini app, core Google Workspace editions | Chats and files are not reviewed by people or used to improve models without permission. | Check that your edition qualifies. Google says additional-service editions do not have these protections. |
| Claude, consumer plans | Chats may be used for training if the Model Improvement setting is on, or if a chat is flagged for safety review. | Settings are per person, so a company cannot rely on them. |
| ChatGPT | OpenAI has separate consumer and business plans with their own data controls. | Read OpenAI's current terms yourself before you approve it. |
A work account does not finish the job. You still need a lawful basis, a check on data leaving Kenya, and care about what staff paste. Microsoft's own page says worldwide traffic can be sent to other countries or regions for processing.
HR is where the risk is highest
Staff are data subjects too. CVs, appraisals, sick notes, payslips and disciplinary files are personal data, and some of it is sensitive.
Three rules matter most:
- Decisions made only by a machine. Section 35 gives every person a right not to be subject to a decision based solely on automated processing that significantly affects them, unless an exception in section 35(2) applies (a contract, a law or the person's consent). Regulation 22 adds duties to inform people, explain the logic, prevent bias and make human intervention available. Rejecting an applicant by AI score alone is likely to fall here.
- High-risk uses. PPC Land's report on the ODPC's July 2026 draft says its Annex 2 requires a Data Protection Impact Assessment (DPIA) for recruitment screening and candidate ranking, and for employee productivity monitoring.
- Telling people. Section 29 requires you to tell people the purpose of collection and which third parties receive their data. Your staff are owed that notice too. If IT can read Copilot logs, say so in your staff notice.
A person who clicks "approve" on every AI recommendation is unlikely to count as real human involvement. Give the reviewer the file, the time and the power to disagree. For hands-on ideas, see our guide on AI training for HR teams in Kenya.
When you need a DPIA
Section 31 requires a DPIA before processing that is likely to result in high risk. Regulation 49 lists examples, including automated decisions with significant effects, sensitive data, data about children or vulnerable groups, large-scale processing, combining datasets, and "innovative use or application of new technological" solutions.
Staff improving a newsletter with no personal data in it does not need a DPIA. A chatbot reading all customer records probably does. If you decide you do not need one, write down why.
Plan the time. Section 31(5) says DPIA reports are submitted sixty days before processing. Under regulation 52(3), if you hear nothing within sixty days of submitting, you may start. A rollout that needs a DPIA has at least two extra months in its timeline.
Worked example: fixing a customer complaint safely
This case is invented for training. A customer care officer at a furniture retailer wants help replying to a complaint.
Before (do not paste this):
Grace Wanjiru, ID 00000000, 0700 000 000, of Kileleshwa, paid KES 86,400 by M-PESA for a sofa on 3 March. Delivery was missed twice. She says she is recovering from surgery and needed it before her mother arrives.
After (safer to paste):
A customer paid in full for a large furniture item. Delivery was missed twice. She has told us the delay is causing real difficulty at home.
What changed:
- Direct identifiers went: name, ID number and phone number.
- Indirect identifiers went: the estate, the exact amount and the date. Together, these could point to one person.
- Sensitive details went: the surgery is health data, and the mother is a family detail.
- The officer keeps the real details in the company's own system and adds them back by hand.
Copy this prompt (it uses the four Cs we teach: Clarity, Context, Constraints, Customisation):
Draft a reply to a customer complaint. Context: we are a furniture retailer in Nairobi. A customer paid in full for a large item and delivery was missed twice. She says the delay is causing real difficulty at home. Constraints: under 120 words. Apologise once and be specific about what went wrong. Do not promise a refund or compensation. Do not invent a date. Write [DATE] where the delivery date goes. Customisation: the reply goes on WhatsApp, so use short sentences and a warm, plain tone. Do not ask the customer for any personal details.
Last test before pasting: could a colleague guess who this is?
Removing a name does not always make data anonymous. Section 2 defines pseudonymisation as data that cannot be linked to a person without extra information kept separately. If your office holds the key, treat the text as personal data.
What can go into an AI tool, by department
This table assumes a general AI tool your company has not assessed. With a contract, transfer safeguards and a DPIA where needed, the middle column can widen.
| Department | Never paste | Only after removing identifiers | Fine to paste |
|---|---|---|---|
| Customer care | M-PESA statements, ID numbers, full complaint threads | The problem, with names and dates removed | Your published FAQs and returns policy |
| Sales | Client lists with contacts, signed contracts | A deal described in general terms | Product sheets, public price lists |
| HR | CVs, payroll, medical notes, disciplinary files | A policy question with no person described | Job descriptions, a draft leave policy |
| Finance | Named salaries, bank details, debtor lists | Totals by category | Excel formula questions, public tax guidance |
When in doubt, treat it as "never" and ask your data protection officer.
A staff rule you can copy today
Paste this into a staff notice and adapt it. It is a starting point, and your lawyer should review it. For a full policy, see our guide to writing an AI usage policy for Kenyan organisations.
Using AI tools at work. You may use AI tools for work if you follow these rules. 1. Use only these tools, with your work account: [list approved tools]. 2. Never paste a person's name, ID or KRA number, phone number, bank or M-PESA details, health details, or family details into a tool that is not on the list. For tools on the list, follow the department table. 3. Remove names, numbers and places before you paste. If a colleague could guess who it is, remove more. 4. Read and check everything AI gives you. You are responsible for what you send. 5. AI must never make a final decision about a person's job, pay, loan or claim. 6. Your prompts on company tools may be logged and reviewed. 7. If you paste something by mistake, tell [name and contact] the same day. You will not be punished for reporting quickly.
Rule 7 matters most. The 72-hour clock starts when the company becomes aware, and people hide mistakes they fear.
What usually goes wrong
| What happens | Why it is a problem | What to do instead |
|---|---|---|
| The company bans AI and stops there | Staff use their phones and personal accounts, and you lose all visibility | Approve a tool and teach safe use |
| The policy is signed and forgotten | Section 42(4) expects real steps, and a PDF nobody read is weak proof | Train with real examples, and keep attendance records |
| Staff think deleting the chat ends the matter | Some providers keep reviewed chats for years | Report it, then follow the steps below |
| A staff member uploads a whole spreadsheet to "clean it" | Hundreds of people's data leaves in one click | Ask for the formula, and keep the data in Excel |
If someone has already pasted personal data
- Record the facts: what was entered, which tool and account, when and by whom.
- Tell your data protection officer or director the same day.
- Contain it. Delete the chat and uploads, and check the history settings. If you have a contract with the vendor, ask in writing for deletion and confirmation.
- Assess the risk. Section 43 applies where an unauthorised person has accessed or acquired the data and there is a real risk of harm. Regulation 37 and the Second Schedule treat identity details linked to items such as salary, bank account numbers, debts, or certain health conditions as carrying that risk.
- Notify the ODPC if required, without delay and within 72 hours of becoming aware. If late, give reasons (section 43(2)).
- Tell affected people in writing within a reasonably practical period, where required.
- Record the facts, the effects and the fix (section 43(8)), even if you decide it is not notifiable.
- Fix the cause: a clearer rule, an approved tool, more practice.
What the regulator can do
- Fines: section 63 sets the maximum at KES 5 million or, for an undertaking, one per cent of the previous year's turnover, whichever is lower.
- Compensation: section 65 lets people claim for damage.
- Offences: where no specific penalty applies, section 73 sets a fine of up to KES 3 million, up to ten years in prison, or both.
We found no published ODPC decision about staff use of AI tools as of 9 November 2026. Recent decisions on ordinary data handling show how the Commissioner thinks:
- Burden of proof on the employer (Complaint 1618 of 2024). EY reports that a solar company used a former sales agent's photo in marketing. It could not prove consent, and the ODPC ordered KES 500,000 in compensation.
- "Human error" rejected (reported April 2026). St. Luke's Orthopaedic and Trauma Hospital in Eldoret was ordered to pay KES 525,000 after a patient twice received another patient's results. The Commissioner dismissed the human error defence and said robust safeguards were needed.
That last point applies directly to AI. "A staff member made a mistake" is a weak answer if you never gave them safeguards.
What is changing
The ODPC's draft Guidance Note on AI (July 2026). Consultation ran from 1 to 17 August 2026, and we found no final version as of 9 November. As a draft it is not binding, but it shows how the regulator reads the Act. Business Daily reports it says deploying firms stay accountable through the AI system's life, and that firms "may not transfer personal data to offshore AI processors without a lawful transfer basis". PPC Land reports it calls for a written data processing agreement and a record of whether each vendor is a processor, controller or joint controller.
The Central Bank of Kenya's draft guidance on AI in banking. Consultation opened on 10 September 2026 and was due to close on 7 November. If you are a bank, see our page on AI training for banks in Kenya.
The Artificial Intelligence Bill, 2026. This is a Bill and not law. The Star reported on 15 October 2026 that the Senate ICT committee recommended that the Senate not proceed with it. Read our explainer on the Bill.
A checklist for the director
- We know whether we must register with the ODPC, and we have.
- We have approved AI tools, on work accounts.
- Every vendor that receives personal data has a contract meeting regulation 24.
- We know where each tool processes data, and we keep transfer records.
- We have a one-page staff rule and everyone has had practice with it.
- No AI system makes a final decision about a person without a human who can overrule it.
- We have done a DPIA for high-risk uses, or written down why not.
- Staff know how to report a mistake within hours.
Questions people ask
Is it illegal to use ChatGPT at work in Kenya?
No. No Kenyan law bans it. The legal risk starts when personal data goes in without a lawful basis, a vendor contract where needed, transfer safeguards and data minimisation.
Do we need customers' consent before using AI on their data?
Not always. A contract or legitimate interests may cover ordinary service work under section 30. You do need express consent for commercial use under section 37, and consent for sending sensitive data outside Kenya under section 49.
Does the Act apply if the AI company is in the United States?
Yes, for your company. You are the controller in Kenya, and sections 25(h), 48 and 49 govern the transfer. Moving the work to a foreign tool does not move the responsibility.
Can we use AI to shortlist CVs?
AI can help sort and summarise. A person should make the decision and be able to overrule the tool. Tell applicants, and expect to need a DPIA, because the regulator's draft guidance reportedly lists recruitment screening among the uses that require one.
Is removing the name enough?
Often not. An estate, a job title and a date can identify someone in a small community. Remove anything that lets a colleague guess who it is.
This article is general information and is not legal advice. Check with your lawyer, your data protection officer or the ODPC before you act.
Sources
- The Data Protection Act, No. 24 of 2019 (official Gazette copy, ODPC), last checked 9 November 2026
- The Data Protection (General) Regulations, 2021 (ODPC), last checked 9 November 2026
- The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (ODPC), last checked 9 November 2026
- PPC Land, report on the ODPC's draft AI guidance note, last checked 9 November 2026
- Business Daily, "Regulator now plans tighter data shields on offshore AI platforms" (4 August 2026), last checked 9 November 2026
- Digital Policy Alert, ODPC consultation on the draft Guidance Note on AI, last checked 9 November 2026
- Digital Policy Alert, CBK consultation on draft AI guidance for banks, last checked 9 November 2026
- The Star, "Senate committee shoots down Nyamu's Bill on AI" (15 October 2026), last checked 9 November 2026
- Microsoft Learn, Copilot Chat privacy and protections, last checked 9 November 2026
- Microsoft Support, data protection in Copilot Chat for work or school, last checked 9 November 2026
- Google, Gemini Apps Privacy Hub, last checked 9 November 2026
- Google, Use Gemini Apps with a work or school account, last checked 9 November 2026
- Anthropic Privacy Center, article on whether data is used for model training, last checked 9 November 2026
- OpenAI Help Center, how your data is used to improve model performance, last checked 9 November 2026
- EY Tax News, ODPC ruling on employees' images (Complaint 1618 of 2024), last checked 9 November 2026
- HapaKenya, St. Luke Hospital ordered to pay KSh525,000 over medical record mix-up, last checked 9 November 2026
Where FuKazee fits in
FuKazee trains private and public sector teams to use AI on the work in front of them. Safe handling of data is part of every session. We assume nobody in the room knows AI yet, and we avoid jargon. We show the free version of every feature, and what happens to the data in each one, so staff can make good choices after we leave. We have trained more than 3,000 people since 2022.
For companies, we practise on your own kinds of tasks, with invented or cleaned examples. Staff leave knowing what to paste, what to remove and who to tell. See how it works on our page for AI training in Kenya. We teach good habits. Your lawyer or data protection officer remains the right person for legal sign-off.
To talk through training for your team, email lead@fukazee.com
Want guided support instead?
Plan AI training around your team's real work. Answer a few quick questions about your sector, team size and goals, and we will recommend the right programme and format. Sessions are built on your workflows and include a usage policy.
Rodney has run FuKazee's training since 2022 and still teaches inside every programme line: corporate sessions, the postgraduate cohort and the KCSE examiner webinars. First Class Honours in Journalism and Mass Communication, University of Nairobi.
