Quick answer: Do not allow it by default. First determine what data is sent, who receives it, where it is stored, whether it is reused for model training, and whether the transfer and processing comply with Kenyan data-protection duties and company policy.
Define the use before comparing vendors
Name the business decision the tool will support, the people affected, the data it needs, the consequence of an incorrect answer and the human who remains accountable. A drafting assistant, recruitment ranker and credit decision tool have different risks. Start with a limited pilot using non-sensitive or properly de-identified data where possible.
Map personal data and cross-border access
List each data type, source, purpose, user, system, storage country, support location and sub-processor. Check controller and processor roles, lawful basis, transparency, retention and data-subject rights. If personal data leaves Kenya or is remotely accessible from another country, check the Data Protection Act’s transfer conditions and ODPC guidance. Confirm whether ODPC registration applies.
Read the vendor terms and security documents
Ask whether prompts and outputs are retained or used to train models; who can access them; where backups sit; how incidents are reported; how subcontractors are controlled; what audit evidence is available; how data is returned or deleted; and how service changes or termination work. Align confidentiality, intellectual-property, indemnity, liability and service terms with the intended use.
Test accuracy, bias and human review
Use representative test cases and log errors before rollout. Decide which outputs require independent verification and prohibit automation of high-impact decisions until the legal basis, risk controls and meaningful human review are clear. Give staff a method to report errors and stop unsafe use.
Set board and procurement controls
Require a named business owner, privacy/security review, procurement approval, documented risk assessment, user training, access controls, retention schedule and periodic reassessment. Define prohibited data and uses. Keep versioned records of prompts, material decisions and human approvals where lawful and proportionate.
A go/no-go record
Before purchase, document the use case, data map, vendor answers, legal basis, DPIA decision, security review, contract owner, human oversight, testing results, incident route and exit plan. If critical answers are missing, narrow the pilot or pause procurement.
Questions people ask
Can staff paste customer information into a public AI chatbot?
Do not allow it by default. First determine what data is sent, who receives it, where it is stored, whether it is reused for model training, and whether the transfer and processing comply with Kenyan data-protection duties and company policy.
Who owns work created by an AI tool?
Ownership and permitted reuse depend on the vendor terms, the human contribution, source material and applicable intellectual-property law. Review the contract and workflow rather than assuming the output is exclusive.
Does every AI system need a data-protection impact assessment?
No. ODPC guidance describes a DPIA where processing is likely to create high risk to data subjects’ rights and freedoms. Assess the actual use, data, scale and context before deciding and document the result.
Official sources and scope
For the current rule and any forms or rates, check the official sources: Data Protection Act 2019 · ODPC guidance notes · ODPC: Data protection laws in Kenya. This guide is general information, not advice on a particular transaction or dispute. Laws, regulations and administrative requirements can change; check the position that applies to your facts before acting.
Related guidance
CS Advocates LLP ICT, data privacy and AI practice. Related reading: AI systems and liability in Kenya · Cross-border data transfers from Kenya · Software and SaaS contract terms.
This is general information, not legal advice on a particular matter, and does not create an advocate-client relationship. For advice on your specific situation, contact CS Advocates LLP for a confidential, conflict-checked consultation.