Data Protection for AI Training: Using Kenyan Personal Data to Train Models Under the DPA

Training an AI model on personal data is processing under Kenya’s Data Protection Act, 2019, whether the data comes from your own customers, scraped public sources, or a purchased dataset. The Act was not drafted with machine learning in mind, but its general provisions apply in full, and they create real friction points for the way AI teams typically build training datasets. There is no AI-specific exemption, and, as of this writing, no finalised regulatory guidance narrowing what the general rules mean for AI training specifically.

Consent is not the only lawful basis, but it isn’t the easy default either

Section 30 of the Data Protection Act sets out several lawful bases for processing personal data, and consent is only one of them. A data controller may also process personal data where necessary for a contract, for compliance with a legal obligation, or for the legitimate interests pursued by the controller or a third party, provided that interest is not overridden by harm or prejudice to the data subject’s rights. In principle, this legitimate-interest basis could support AI training without needing individual consent from every data subject. In practice, two things narrow that route considerably. First, section 25’s purpose-limitation principle requires personal data to have been collected for an explicit, specified, and legitimate purpose, and prohibits further processing incompatible with that purpose; using a dataset collected for one purpose, such as customer onboarding or service delivery, to train an AI model is a new and different purpose, and whether that qualifies as “incompatible” is a genuine, unresolved interpretive question under Kenyan law. Second, if any of the training data falls into a sensitive category, the legitimate-interest route is effectively closed off in favour of a stricter regime, discussed below.

Minimisation and retention don’t pause for machine learning

Section 25 also requires personal data to be adequate, relevant, and limited to what is necessary for its processing purpose, and to be kept in identifiable form no longer than necessary. Section 39 adds a general retention-limit duty. Neither provision is disapplied for AI or research use, and Kenya’s Act contains no equivalent of the kind of research-specific derogation found in some other data protection regimes. A training pipeline that indefinitely retains raw personal data “in case it’s needed for retraining,” or that ingests broader categories of data than the specific model actually requires, sits in real tension with these principles as written, regardless of how standard that practice is in machine learning generally.

Sensitive personal data needs its own analysis

Where training data includes sensitive personal data, defined under the Act to include health status, biometric data such as facial or voice characteristics, genetic data, and similar categories, sections 44 to 46 apply on top of the general regime. Section 44 requires that sensitive personal data only be processed where section 25’s principles are satisfied, and section 45 permits it only on a narrower set of grounds than ordinary personal data, generally requiring the data subject’s explicit consent absent a specific statutory exception. A facial-recognition or voice-model training dataset, or a health-tech AI product trained on patient records, needs its lawful basis analysed separately from a general-purpose text or product-recommendation model built on ordinary customer data.

No dedicated AI guidance exists yet, and be careful what you rely on

As of this research, the Office of the Data Protection Commissioner has not published finalised guidance specifically addressing AI or AI training under the Data Protection Act. Its live list of draft guidance notes covers the transport sector, cross-border data transfers, institutional data protection policy, and data protection officers, with no AI-specific item on it. Some secondary commentary has referenced draft ODPC guidance on artificial intelligence and privacy-enhancing technologies, but we were not able to corroborate this directly against ODPC’s own published materials, and it may be conflating ODPC’s work with the Ministry of Information, Communications and the Digital Economy’s separate draft AI and Emerging Technologies Policy, which is not a data protection instrument at all. The Data Commissioner has made public remarks urging AI developers to assess the connection between data processing and AI model development and to conduct data protection impact assessments, but remarks at a conference are not binding guidance. Businesses should build their AI training compliance on the Act’s existing general provisions, not on guidance that does not yet exist in confirmed final or draft form.

Registration: most AI startups aren’t automatically exempt, but many are automatically caught

Every data controller or processor must register with the Data Commissioner under section 18 of the Act, unless exempted. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 exempt an entity from registration only where its annual turnover is below KES 5 million and it has fewer than ten employees, and even then only from the registration requirement itself, not from the Act’s substantive obligations. Separately, roughly a dozen sectors, including health administration and patient care, financial services, telecommunications, and genetic data processing, must register regardless of size. An AI startup building a health-tech, fintech, or biometric product should assume it needs to register even while pre-revenue; a startup outside those listed sectors and below the turnover and headcount thresholds is more likely to be exempt from registration itself, but remains bound by every other obligation discussed above.