Kenya ODPC Seeks Data Protection Act Changes for AI

In Short

Kenya’s Office of the Data Protection Commissioner, ODPC, says the Data Protection Act, 2019 needs updates as AI use and cross border data transfers grow.

What Happened: Why Kenya’s ODPC Wants Legal Updates

Kenya’s Office of the Data Protection Commissioner, ODPC, says the country’s digital economy is moving faster than parts of the legal and investigative tools meant to protect personal information.

The regulator was established under the Data Protection Act, 2019. The law set out how organisations should collect, process, store and share personal information.

Six years into implementation, Immaculate Kassait, Kenya’s first Data Commissioner, says the Act requires amendments. She says the changes should cover artificial intelligence, sensitive personal information, penalties and data governance.

Kassait also says the ODPC needs stronger powers to investigate organisations operating outside Kenya. She says the office also needs more time to determine complaints.

The ODPC’s concerns come as more organisations adopt offshore software and cloud platforms, and as government agencies work toward interconnected digital systems. The ODPC has also proposed new safeguards for Kenyan organisations transferring personal data to offshore AI providers.

A leadership transition is also underway. President William Ruto nominated Lydia Sitienei Chelagat, the Communications Authority of Kenya’s Director of Legal Services, to succeed Kassait. Chelagat’s nomination was announced on 10 November 2026 and forwarded to the National Assembly for consideration.

Why It Matters

For Kenyan businesses using AI, meaning software that can make decisions or predictions from data, the regulator is signalling that current rules may not fully cover modern data use cases.

For companies moving data to offshore AI providers and cloud services, the ODPC is pushing for clearer safeguards and more enforcement reach beyond Kenya’s borders.

The next commissioner will inherit a more complex regulatory environment, as more parts of the economy develop their own requirements for handling personal information.