Glossary
What is the KDPA?
The Kenya Data Protection Act, No. 24 of 2019, is the primary statute governing personal data in Kenya.
For AI buyers, the pressure points we cite are Section 41 (privacy by design), Section 48 (sending personal data out of Kenya), and Section 50 (Cabinet Secretary may require certain strategic processing through a Kenya server). Penalties in the Act can reach KES 5 million or 1% of annual turnover. Outside legal advice.
Foreign cloud AI stays short of automatic illegality for every use case. It becomes dangerous when sensitive personal data is processed outside Kenya without a lawful transfer basis. Read the full pillar: KDPA compliance for AI.