ODPC Guidance Note on Artificial Intelligence

What it is

The Guidance Note on Artificial Intelligence is the Office of the Data Protection Commissioner’s guidance on how Kenya’s Data Protection Act 2019 and its regulations apply to AI systems that process personal data. It is dated July 2026 and was released as a draft for consultation. It describes itself as a minimum standard that entities can go beyond, and says entities in regulated sectors should also follow sector guidance from the ODPC and their sector regulators.

The note does not create new law. It applies the Act, the Data Protection (General) Regulations 2021, the registration and complaints regulations and the Constitution to the way AI is built and used. Because it is the Data Commissioner’s own reading, it is the clearest signal of what the ODPC will look for in a complaint or inspection involving AI.

Who it applies to

The note applies to public and private entities that develop AI systems trained on personal data, deploy AI systems that produce outputs, recommendations or decisions using personal data, procure AI-as-a-service products that process personal data, or use AI in automated decision-making that affects data subjects. It defines AI developers, providers, deployers, foundation model providers and users, and asks entities to allocate controller, joint controller and processor roles among them.

What it requires

AI outputs are personal data

The note treats inferences about identifiable people, such as behavioural profiles, risk scores and predictions, as personal data under section 2 of the Act, along with outputs such as classifications, recommendations and automated decisions. Compliance therefore covers the whole processing chain, not just collection.

Automated decisions

For decisions that significantly affect people, such as credit, employment, insurance, housing, healthcare, education or access to public services, the note says entities shall ensure decisions are not made solely by automated means without meaningful human involvement, tell people when a decision was automated, offer human review, give a meaningful explanation of the logic on request, and let people contest the decision before a human with authority to change it. It adds the regulation 22 duties to prevent errors, use appropriate statistical procedures and eliminate discriminatory effects and bias.

High-risk AI applications

Section 9 lists high-risk categories, each needing at least a mandatory DPIA, DPO involvement subject to section 24, meaningful human review of automated decisions and regular algorithmic audit.

• Credit scoring and financial decisioning. Section 35 human review, explanation of principal scoring factors on request and regular bias audit.
• Health diagnostics and clinical decision support. Explicit consent or a specific legal basis for health data, and a DPO.
• Biometric recognition. Explicit consent or a statutory basis, a DPO, and no real-time biometric surveillance without specific legal authority.
• Employment screening and monitoring. Disclosure to candidates and staff, and human review of AI-recommended hiring or termination decisions.
• Education. Children’s data protections, parental consent and no commercial profiling of children.
• Generative AI platforms. Privacy notices that disclose generative AI processing, training data audits and output monitoring.
• Law enforcement and public safety. Specific statutory authority and independent oversight.

Annex 2 adds a DPIA trigger table. Credit scoring, recruitment screening, fraud detection in payments, content recommendation, facial recognition and employee productivity monitoring are marked as needing a DPIA. A generative AI chatbot with no personal data input is marked for review.

Governance, vendors and breaches

Section 11 asks every entity that develops or deploys AI on personal data to document an AI governance framework proportionate to its AI use. It should set out oversight structures and reporting lines to senior management, roles across the AI lifecycle, the DPO’s role, the standards and frequency of algorithmic audits covering performance, bias, drift and data protection, standards for meaningful human oversight, and change and incident management.

Third-party AI providers need a written data processing agreement where they act as processors. Cross-border transfers to offshore AI processors need a lawful basis under Part VI of the Act, with an assessment of the receiving jurisdiction and contractual or other safeguards where adequacy cannot be shown. A breach affecting AI systems, including model extraction or adversarial manipulation, must be notified to the ODPC within 72 hours where it is likely to result in risk.

Section 10 sets a pre-processing checklist, and Annex 1 a compliance checklist, covering lawful basis, data classification, minimisation, DPIA, transparency, accountability, third parties, transfers and security.

Key dates

• July 2026. The ODPC releases the Guidance Note on Artificial Intelligence as a draft for consultation.

How it relates to other frameworks

The note is close in approach to the UK ICO’s guidance on AI and data protection. Both apply existing data protection law across the AI lifecycle rather than creating AI-specific rules. Its section 11 governance framework reads like a compact version of an ISO/IEC 42001 management system, and its high-risk list overlaps with the high-risk areas in the EU AI Act. For banks and other licensed institutions, the CBK’s draft Guidance Note on AI adds sector requirements on top.

A note on this page

This is Aicura’s reading of the ODPC’s draft Guidance Note on Artificial Intelligence. It is not legal advice and it is not the note itself. Read the note as published by the ODPC, check whether a final version has been issued, and take advice on how it applies to your organisation.