Data Privacy for AI Systems
AI systems over collect and over retain. Both are obligations under the Act.
What is data privacy for AI?
Data privacy for AI means applying the Data Protection Act to systems that use personal data, covering lawful basis, how much data a system may hold, how long it keeps it, where it is processed, and what you must be able to show if asked.
The Data Protection Act applies to AI exactly as it applies to anything else. There is no separate regime and no allowance for the technology being new, which surprises organisations who assumed a gap existed.
AI systems strain two principles in particular. Minimisation, because these systems are built to consume as much data as they can reach, and storage limitation, because data gets copied into places nobody is tracking and then stays there.
The third issue is location. Most AI providers process data outside Kenya, which creates a cross border transfer obligation. Using one is not automatically a breach, and doing so without addressing the obligation is a different matter.
Where our work stops and your lawyer starts
Duara works on the technical side of data protection for AI systems in Kenya, covering what systems hold, where they process it and what records exist.
We are not lawyers and do not give legal advice. We establish what your systems actually do with personal data and what has to change, and your counsel or the Data Commissioner confirms the legal position on anything genuinely contested.
Who this is for
- Your AI systems process personal data
- You use overseas AI providers
- You cannot say what your systems retain
- You need to show compliance rather than assume it
Industries we serve
- Financial services
- Healthcare
- Insurance
- Telecommunications
- Education
- Any organisation holding customer data
Problems this solves
These are the specific ways AI systems create data protection exposure.
- Systems take more than the task needs. AI tends to be given everything available rather than the fields required, which is the minimisation principle breached by design.
- Data kept longer than intended. Copies accumulate in logs, prompts and training sets that nobody is tracking, so retention limits apply to data nobody can find.
- Cross border transfers not addressed. Most providers process outside Kenya. That is not automatically a breach, and it is an obligation that has to be handled rather than assumed away.
- Nothing to show. The Act requires you to demonstrate compliance rather than simply be compliant, and most organisations have no records to produce.
What we deliver
A clear account of what your systems hold and where, data reduced to what the task needs, retention actually enforced, transfers handled properly, and records you can produce.
What each system holds, and where it is processed
Data reduced to what the task genuinely requires
Retention limits enforced rather than stated
Cross border transfers addressed properly
Records you can produce if asked
A written list of anything we consider genuinely uncertain
Features
- Minimisation applied to inputs. Systems given the fields the task needs rather than everything available, which is where most AI over collection begins.
- Retention that actually deletes. A stated retention period that nothing enforces is a policy rather than a control, and the copies in logs are the ones that catch people.
- Transfers handled deliberately. Overseas processing is addressed rather than assumed away, because using a foreign provider is a transfer whether or not anybody called it one.
- Evidence produced, not promised. The Act requires you to show compliance, which means records that exist before somebody asks for them.
- Uncertainty written down. Where the position is genuinely unsettled we say so rather than giving you false confidence in our reading of it.
Benefits
- You can answer the question. Knowing what each system holds and where turns a regulator enquiry from a crisis into an afternoon.
- Less data at risk. Systems holding only what they need lose less when something goes wrong, which is the cheapest security control available.
- Transfers on a defensible footing. Addressed obligations survive scrutiny in a way that an unexamined overseas provider does not.
- Breach response is possible. Notification duties run on short timelines, which you cannot meet without knowing what data was involved.
What the Act requires of AI systems
- Lawful basis. A specific ground for processing each category of personal data, decided rather than assumed.
- Data minimisation. Holding only what the purpose requires, which AI systems breach more easily than conventional software.
- Storage limitation. Keeping data only as long as needed, including the copies inside logs and prompt histories.
- Cross border transfer. Conditions that apply when personal data is processed outside Kenya, as most AI providers do.
- Impact assessment. Required where processing is likely to result in high risk, which covers a good deal of AI use.
- Breach notification. A duty to notify the Data Commissioner within seventy two hours where a breach poses real risk of harm.
The accountability principle is the one organisations underestimate. Being compliant is not sufficient. You must be able to demonstrate it, which means the records have to exist before anybody asks.
How the process works, step by step
A privacy review usually takes two to four weeks depending on how many systems process personal data.
-
Step 1
Free scoping call
We establish which systems touch personal data and whether you already know what they hold.
-
Step 2
Systems traced
What each one takes in, where it processes, what it keeps and for how long, which frequently differs from what people believe.
-
Step 3
Obligations identified
Which duties apply to your specific use rather than a general summary of the Act.
-
Step 4
Changes made
Inputs reduced, retention enforced, transfers addressed, and records put in place.
-
Step 5
Evidence assembled
Documentation you can produce, since demonstrating compliance is itself an obligation.
Quality assurance and how we work
The commitments attached to work with legal consequences.
- We are not lawyers and say so. We do the technical work and your counsel confirms the legal position, because a supplier interpretation is not a defence.
- We tell you what your systems actually hold. This regularly differs from what people believe, and the difference is usually the exposure.
- We write down what is uncertain. Some positions are genuinely unsettled, and giving you false confidence about them helps nobody.
- We do not claim a system is compliant. Compliance is your position to hold. We can tell you what we found and what we changed.
- We reduce data before adding controls. Data a system never receives needs no protecting, which is cheaper and more reliable than protecting it.
Frequently asked questions about data privacy for AI
Does the Data Protection Act apply to AI?
Yes, in full. There is no separate regime for AI and no allowance for the technology being new.
Which principles do AI systems break most?
Minimisation and storage limitation. These systems are built to consume as much data as they can reach and to leave copies behind.
Does using an overseas provider breach the Act?
Not automatically. It creates cross border transfer obligations that have to be addressed rather than assumed away.
How long can we keep data?
As long as the purpose genuinely requires and no longer. The harder question is usually whether anything actually deletes it.
What counts as personal data here?
Anything identifying a living person, which includes far more inside AI prompts and logs than most organisations expect.
Do we need an impact assessment?
Where processing is likely to result in high risk, yes, and a good deal of AI use falls into that category.
What happens if there is a breach?
The Data Commissioner must be notified within seventy two hours where there is real risk of harm, which you cannot do without knowing what was involved.
Do we have to register as a data controller?
Many organisations do. Smaller ones fall below a threshold, though several sectors must register regardless of size.
Are staff pasting data into chatbots a problem?
Frequently yes, and it is the most common exposure we find, because nobody recorded what was sent or where it went.
Can we use AI on customer data at all?
Usually, with a lawful basis, minimised inputs and the transfer position addressed. The Act restricts how rather than whether.
What records do we need?
Enough to demonstrate compliance rather than assert it, since demonstrating it is itself an obligation under the Act.
Does anonymised data solve this?
Genuinely anonymised data falls outside the Act. The difficulty is that most data organisations call anonymised is not.
Can we keep everything in Kenya?
For some workloads yes, and it removes the transfer question entirely, though it constrains which providers you can use.
Should our lawyer be involved?
Yes. We establish what your systems do and what has to change, and your counsel confirms the legal position on anything genuinely contested.
Will you tell us we are compliant?
No. Compliance is your position to hold. We can tell you what we found and what we changed.
What are the penalties?
The Act provides for administrative penalties, which is a reason to address this deliberately rather than the main one.
How long does a privacy review take?
Two to four weeks, depending on how many systems process personal data and how well documented they already are.
Can you fix things as well as find them?
Yes, and reducing what systems collect is usually the first change, since data never received needs no protecting.
Who sees our data during the review?
We work from system configuration and records rather than needing the personal data itself wherever that is possible.
What does a privacy review cost?
The number of systems and how much documentation already exists determine it, quoted after the scoping call.
Glossary of terms
Data protection terms in plain language.
- Lawful basis
- The specific ground that permits you to process personal data, which must be identified rather than assumed.
- Data minimisation
- Holding only the data the purpose requires, which AI systems breach easily because they are built to consume.
- Storage limitation
- Keeping data only as long as needed, including copies in logs nobody is tracking.
- Cross border transfer
- Processing personal data outside Kenya, which most AI providers do and which carries conditions.
- Data protection impact assessment
- A required assessment where processing is likely to result in high risk to people.
- Accountability
- The duty to demonstrate compliance rather than simply achieve it, which requires records.
- Data subject rights
- What individuals can require of you, including access to and correction of their data.
Related services in AI Compliance
Talk to us about data privacy for AI
Pick one AI system and try to write down every category of personal data it holds. The gaps in that list are where to start.
Start your project