Using AI safely: data protection rules for East African companies

AI tools can save your team hours every week. But every time someone pastes customer data into a public chatbot, your company may be breaching data protection law. Here is how to get the benefits of AI without the risk.

The laws already apply to AI

East Africa does not yet have AI-specific laws in force, but the data protection laws of Kenya, Uganda, Tanzania and Rwanda already cover any AI use that involves personal data. That means:

• You need a lawful basis for using personal data in an AI tool.
• Sending data to an AI provider abroad is usually a cross-border transfer, which needs safeguards.
• Automated decisions that significantly affect people, such as credit scoring, can give them a right to object or ask for human review.
• High-risk AI processing usually requires a Data Protection Impact Assessment (DPIA).

Risk 1: staff using public AI tools

The most common problem is not AI products. It is everyday use. Staff paste customer emails, CVs, medical notes or spreadsheets into free AI tools to save time. Depending on the provider's terms, that data may be stored or used to train models.

What to do: write a short AI usage policy that says which tools are approved, what data must never be entered, and when to anonymise first. Then train your team on it.

Risk 2: AI features in your product

If you build AI into your product, such as a support chatbot, document processing or recommendations, treat it like any other high-risk processing:

1. Run a DPIA before launch.
2. Choose providers with business terms that don't train on your data, and check where data is processed.
3. Tell users clearly when they're interacting with AI and how their data is used.
4. Minimise the personal data you send to the model.
5. Keep a human in the loop for decisions that significantly affect people.

A simple starting checklist

• List every AI tool your team uses today
• Approve the safe ones, and block or replace the rest
• Publish an AI usage policy and train staff
• Update your privacy notice to cover AI use
• Run DPIAs for AI features in your product

How Solfa Tech helps

We help companies adopt AI in both directions: building useful AI features and putting the governance in place to keep them compliant. Our own website assistant, Solfa AI, is an example of what we build.

This guide is general information, not legal advice. Laws and regulator practice change, so confirm specifics for your situation.