Resources
KDPA compliance for enterprise AI in Kenya.
A practical guide for CTOs and counsel: what breaks, what is safe, and how to deploy private AI without the slide-deck theatre.
Every time staff paste customer or employee data into a foreign LLM, that content is processed outside Kenya. For regulated sectors, that is a DPO and counsel question, beyond a productivity tip.
The Kenya Data Protection Act (No. 24 of 2019) and ODPC enforcement posture make data residency a board-level issue. Penalties can reach KES 5 million or 1% of annual turnover.
The risk
Where cloud AI collides with Kenyan law.
Localisation pressure
Section 50 lets the Cabinet Secretary require certain strategic processing through a Kenya server. That is falls short of a general “every prompt stays in Nairobi” rule, ask counsel.
Cross-border transfer
Moving personal data abroad needs a lawful basis and controls, “the model is smart” is fails as a basis.
Shadow AI
Teams adopt ChatGPT before security does. The data already left.
Enforcement
ODPC is active. AI gets no special exemption because it is new.
The path
From exposure to a private endpoint.
Related
Go deeper by sector and definition.
Banking
CBK-aware copilots and KYC assist on private infra.
Insurance
Claims intelligence without foreign processors.
Sovereign AI
Definition and why it counts in Kenya.
vs ChatGPT
Side-by-side for executives and risk.
Does the KDPA ban ChatGPT?
The Act skips a product name. The risk arises when sensitive personal data is processed on servers outside Kenya without meeting localisation and transfer requirements.
What is Section 41 about?
The ODPC AI Guidance Note (July 2026) reads Section 41 as privacy by design and default. Localisation for prescribed strategic processing sits in Section 50. Cross-border conditions sit in Section 48. Confirm with counsel.
How does Corvux help?
We audit current AI usage, deploy open-weight models on Kenya-based GPUs, and integrate a local API so apps stop calling foreign LLMs for sensitive work.
What did ODPC publish in July 2026?
A Guidance Note on Artificial Intelligence. It applies the Data Protection Act to AI that processes personal data of people in Kenya. Read the official PDF with counsel, counsel owns the legal reading of this page.
Who this is for
CTOs, CISOs, and counsel who need a clear AI risk story.
Banks and MFIs
Customer data, KYC packs, and internal policy cannot be pasted into foreign chatbots without creating localisation and transfer questions under the KDPA.
Insurers
Claim files and medical attachments are sensitive personal data. Speed cannot come at the cost of sending them to US or EU inference endpoints.
Hospitals and clinics
Clinical notes and discharge summaries belong on hospital-controlled infrastructure, hospital infrastructure, off any public SaaS model.
Public sector
Citizen records and policy corpora should remain under Kenyan jurisdiction when AI is applied at scale.
What “good” looks like
A private endpoint your apps can trust.
The destination state is simple: sensitive prompts and documents are processed on GPUs in Kenya, behind your identity and network controls, with logs you can show an auditor. Public tools can still exist for non-sensitive drafting, but they are no longer the default for customer or employee data.
Corvux implements that destination with open-weight models, a local API layer compatible with how your engineers already call LLMs, and optional agents for claims, compliance search, and document workflows. See infrastructure, agents, and sector pages for banking and insurance.
If you need an executive comparison before an RFP, use Private AI vs ChatGPT and on-premise vs cloud AI. For definitions your board will understand, start with sovereign AI and data residency.
Common objections
What we hear in Nairobi boardrooms.
“We already have Microsoft”
Having M365 or Azure falls short of meaning sensitive LLM inference stays in Kenya. Check the actual model region, logging, and whether staff still use public ChatGPT beside it.
“Open-weight models are weaker”
For many enterprise tasks, policy Q&A, summarisation, classification, well-chosen open weights on local GPUs outperform a stronger foreign model you lack permission to use on real data.
“We will wait for clarity”
Waiting while shadow AI spreads increases the backlog of non-compliant data flows. An audit plus a private pilot is usually cheaper than a rushed remediation later.
“Self-hosting is too hard”
That is the point of Corvux: we deploy, integrate, document, and train your team. You keep the keys and the residency story.
Still deciding? Read what the KDPA is, then book a concrete audit via contact. The output is a written map of exposure, a written map, free of buzzword slides.
ODPC, July 2026
The Commissioner now has an AI guidance note.
In July 2026 the Office of the Data Protection Commissioner published a Guidance Note on Artificial Intelligence. It applies the Data Protection Act and the 2021 regulations to AI developers, deployers, and buyers that process personal data of people in Kenya. It is an ODPC note, outside Corvux. Read it with counsel.
What the note stresses, in our reading: register or update your registration if AI processing is new; name a lawful basis; treat third-party model APIs as processors or controllers after you assess the facts; update privacy notices; and, for generative systems, watch memorisation, false content about real people, and cross-border transfers. Local GPUs still require those steps. They change where inference happens.
Request a KDPA AI compliance audit
A written map of exposure and a scoped private-stack path, a scoped path, free of a fake 30-day SLA.
Start the audit