Kenya's Data Protection Act 2019 holds data controllers and processors responsible for how personal data is used, including by AI agents. It also gives people a right not to be subject to solely automated decisions with significant effects. Staff who supervise agents in Kenyan firms must be trained to keep agents to purpose, review significant decisions and report breaches.
What does the Act ask of staff who work with agents?
The Data Protection Act 2019 sets principles for processing personal data in Kenya. In substance, data must be processed lawfully, fairly and transparently; collected for explicit, specified purposes and not used in incompatible ways; limited to what is necessary; kept accurate; held no longer than needed; and kept secure. Sensitive personal data, such as health, ethnic origin and biometric data, faces stricter conditions.
People have rights to be informed, to access their data, to object, to correction and deletion, and not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects, subject to exceptions. Controllers must carry out an impact assessment where processing is likely to result in high risk, and must notify the Office of the Data Protection Commissioner of breaches promptly, and affected people where there is real risk of harm. Controllers and processors above certain thresholds must register with the Office, and some must designate a data protection officer. Transfers outside Kenya are allowed only on conditions the Act sets.
The automated decision right is the one that changes training most. A collections agent that refers a borrower to a credit bureau, or a lending agent that declines an application, may be making exactly the kind of decision the right covers. Someone must be able to review it meaningfully.
Who does it apply to?
Controllers and processors established or resident in Kenya, and those outside Kenya processing personal data of people in Kenya. Sector regulators add their own expectations: the Central Bank of Kenya for banks, microfinance, payment service providers and digital credit providers; the Capital Markets Authority for investment firms; and the Insurance Regulatory Authority for insurers.
A note on words. In Kenyan financial services, "agent" often means a person running a till for a bank or mobile money network. Training should be clear that an AI agent is software acting within bounds, and that the human agent network and AI agents raise different data questions.
Staff in scope include contact centre staff supervising chat and voice agents, credit and collections teams reviewing agent decisions, operations staff releasing agent actions, data and IT teams setting agent sources, and the data protection officer. The DPO's role is covered in what a data protection officer is. A sector view is in what AI agent training organisations in Kenya need.
What competence does the Act imply when agents act?
Purpose and minimisation. Each agent should read only the data its task needs, for a specified purpose. Staff who connect new sources, such as mobile money transaction histories, must check the purpose and whether people were told.
Reviewing automated decisions. Where an agent's decision has significant effect, such as declining credit, reducing a limit or listing a borrower with a bureau, it should be held for a named person, or the person affected must be able to obtain review. That reviewer must have authority to change the outcome and must weigh information the agent did not see.
Collections conduct. Agents that contact borrowers must never disclose debts to the borrower's contacts or use their phone book. Staff must recognise when an agent's draft would breach that line, and such messages should be refused by the agent's bounds.
Accuracy. Supervisors must check agent facts against sealed records from the core system, and treat declared statements and external documents as weaker.
Breach recognition. An agent that sends data to the wrong person, or reveals one customer's details to another, has likely caused a breach. Staff must report it at once so the controller can notify the Office in time.
Cross-border processing. Many model providers process data outside Kenya. Staff configuring agents must know where data goes and on what basis.
Payments operations are a focus for the Central Bank; AI agent training for payments operations staff in retail banking in Kenya covers that role. Any agent movement of money is depth 4 and held for a named person.
How do you meet the Act and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Purpose limitation and minimisation | Agent sources mapped to purposes; least access | Source register |
| Right on automated decisions | Significant agent decisions held for trained reviewers; review on request | Hold and release log; review requests |
| Impact assessment | DPIA for agents processing high-risk data | Approved DPIA |
| Security and breach notification | Staff trained to recognise and report agent-caused breaches | Training records; incident log |
| Cross-border transfers | Data location and transfer basis recorded for each agent | Transfer register |
| Registration and DPO | Registration current; DPO involved in agent decisions | Registration certificate; DPO sign-offs |
| Record | Every agent verdict filed with sources used | Append-only decision record |
What will the ODPC or an auditor ask?
- What personal data does each agent use, and for what purpose?
- Which agent decisions significantly affect people, and who reviews them?
- Did you carry out an impact assessment before deployment?
- How would staff recognise a breach caused by an agent?
- Where do your model providers process data?
- What training have supervisors received?
What does the Act not cover?
It does not set prudential or conduct rules for financial firms; the Central Bank, CMA and IRA do. It does not regulate AI as a technology. It does not prescribe training content or certificates. And it does not override other laws requiring disclosure, such as anti-money laundering reporting. Neighbouring regimes are similar in shape; compare the Nigeria Data Protection Act and staff training and the UAE Personal Data Protection Law. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does Kenya's Act give a right against automated decisions?
Yes, in substance. People have a right not to be subject to solely automated decisions with legal or similarly significant effects, subject to exceptions.
Can a collections agent message a borrower's contacts?
No. Disclosing a debt to third parties breaches data protection principles. Bound collections agents so such messages are refused.
Do small firms need to register with the ODPC?
Registration depends on thresholds and sector. Check with counsel; many firms handling customer financial data will need to.