Staff at a Nairobi bank paste customer statements into ChatGPT to draft a credit memo. A marketing team at a Mombasa logistics firm uploads a client contact list into a generative AI tool to write personalised outreach. A SACCO analyst asks Claude to summarise member complaints, pasting names and ID numbers into the prompt. None of these actions were malicious. All of them are potential violations of the Kenya Data Protection Act, 2019.
AI governance for Kenyan enterprises is no longer a future problem. The Office of the Data Protection Commissioner (ODPC) has already issued enforcement notices and financial penalties against organisations for far simpler data handling failures. Generative AI amplifies every existing weakness: unclear data flows, weak vendor oversight, and staff who move faster than policy. This guide walks through the governance structures, acceptable use policies, and technical controls you need to manage AI risk in a way regulators and auditors will accept.
Why AI Risk Is a Kenya Data Protection Act Issue
Section 25 of the Kenya Data Protection Act sets out the principles of lawful processing: purpose limitation, data minimisation, and accountability. When an employee pastes personal data into a public LLM, three things happen that put you offside:
- Cross-border transfer: The data leaves Kenya, usually to servers in the US or EU, without the safeguards required under Section 48.
- Unlawful further processing: The AI vendor may use that data to train future models, which is a purpose the data subject never consented to.
- Loss of control: You cannot honour a data subject's right to erasure under Section 40 if their data is embedded in a model's training set.
Automated decision-making adds another layer. Section 35 gives data subjects the right not to be subject to decisions based solely on automated processing. If you use AI to score loan applications, screen CVs, or flag insurance claims without meaningful human review, you need explicit safeguards and, in most cases, a Data Protection Impact Assessment.
If your AI use case processes personal data, sensitive personal data, or drives decisions that affect individuals, a DPIA is not optional. It is your primary evidence of accountability when the ODPC comes asking.
Build an AI Governance Structure That Actually Works
Governance fails when it lives only on paper. A workable AI governance model for a Kenyan enterprise has three layers:
AI Steering Committee
A cross-functional group chaired by the DPO or CISO, with representation from Legal, IT, Risk, and the business units actually deploying AI. This committee approves use cases, reviews DPIAs, and maintains an AI inventory.
AI Use Case Register
A living document listing every approved AI tool and use case: what data it processes, the lawful basis, the vendor, the data residency, and the risk rating. If it is not on the register, it is not approved. Auditors love registers because they make accountability tangible.
Tiered Approval Gates
Not every AI use case needs the same scrutiny. A tiered model works:
- Tier 1 (Low risk): Public data, no personal data, no decisioning. Example: using AI to draft internal training material. Manager approval.
- Tier 2 (Medium risk): Internal data, limited personal data, human-in-the-loop. Example: AI-assisted email drafting inside a private tenant. DPO sign-off.
- Tier 3 (High risk): Sensitive personal data, automated decisions, or customer-facing AI. Full DPIA, Steering Committee approval, and often ODPC consultation.
Draft an Acceptable Use Policy Staff Will Actually Follow
A good AI Acceptable Use Policy (AUP) is short, specific, and enforceable. Avoid the temptation to write a 40-page document nobody reads. The essentials:
- Approved tools list: Name the specific tools staff may use (e.g. Microsoft Copilot on the enterprise tenant, ChatGPT Enterprise). Anything else is prohibited by default.
- Prohibited data categories: Explicitly ban customer PII, ID numbers, financial account data, health information, source code, and unpublished financials from being pasted into any AI tool not on the approved list.
- Attribution and verification: Any AI-generated content used in customer communications, regulatory filings, or code must be reviewed by a qualified human. Hallucinations are your liability, not the vendor's.
- Disclosure: Staff must disclose material use of AI in decisions affecting customers or employees.
- Consequences: Tie violations to the existing disciplinary framework. Vague policies get ignored.
Pair the policy with training. A one-hour session covering what generative AI actually does, what data must never touch it, and how to recognise an AI hallucination will do more for your risk posture than any technical control.
Technical Controls Auditors Will Accept
Policy without enforcement is theatre. The controls that matter:
- DNS and CASB filtering to block unsanctioned AI tools at the network layer.
- Data Loss Prevention (DLP) rules that detect and block ID numbers, KRA PINs, and account numbers in outbound prompts.
- Enterprise AI tenancy: Use Copilot for Microsoft 365 or ChatGPT Enterprise, where prompts are not used for training and data residency is contractually defined.
- Logging and monitoring: Capture prompts and responses for high-risk use cases. If you cannot show an auditor what was asked, you cannot defend the outcome.
- Vendor due diligence: Every AI vendor is now a data processor under Section 42. You need a Data Processing Agreement, evidence of their security posture, and clarity on sub-processors.
Vendor Risk Management Service Page
The Regulatory Direction of Travel
Kenya does not yet have a standalone AI law, but the direction is clear. The National AI Strategy 2025–2030 signals stricter oversight, and the ODPC has publicly flagged AI as a supervisory priority. The EU AI Act will affect any Kenyan enterprise serving European customers. ISO/IEC 42001, the new AI management system standard, is emerging as the certifiable benchmark, much as ISO 27001 became for information security. Organisations that build governance now will not scramble later.
Ready to assess your posture? Contact SecureZaidi for a free consultation on building an AI governance framework aligned to the Kenya Data Protection Act and ISO 42001.