Kenya Proposes Stricter Data Protections for Offshore AI Processing

Kenya's Office of the Data Protection Commissioner (ODPC) has issued new draft guidance that aims to hold Kenyan organizations accountable for personal data transferred to offshore AI platforms. This move is designed to ensure that personal information remains protected throughout its lifecycle, even when processing occurs in another jurisdiction, placing legal responsibility squarely on the Kenyan entity.

The proposed rules mandate that organizations assess the data protection adequacy of the destination country before transferring data for AI processing. If adequate protections aren't present, businesses must implement contractual safeguards, such as binding corporate rules, to ensure Kenyan privacy standards are maintained. Additionally, written data processing agreements with offshore AI vendors will become a legal compliance obligation, detailing how data will be collected, stored, processed, and protected.

This initiative reflects a broader trend in Kenya's AI regulatory strategy, which seeks to establish a comprehensive governance framework for AI. It complements earlier proposals that focused on risk-based oversight for AI providers and high-risk applications, by specifically addressing the cross-border movement and protection of personal data. The ODPC's guidance underscores that organizations cannot outsource their responsibility for protecting personal information by simply using foreign AI services.

The impact will be most significant for sectors handling sensitive data, like banking, insurance, healthcare, and telecommunications, which heavily rely on global AI tools for various operations. These organizations will likely need to review vendor contracts, cross-border data flows, and internal governance processes. The proposal emphasizes that data governance must be a core component of AI adoption, rather than an afterthought, encouraging a more structured approach to sharing personal data with AI providers.