Data protection laws and AI in Kenya, Uganda, Nigeria and beyond

Picture the bursar of a private school in Nakuru at the end of term. She has a list of forty parents who still owe fees, with their names, phone numbers and balances, and forty polite reminder messages to write. An AI assistant could draft them in a minute. She copies the list and pastes it into the chat.

It feels like using a calculator. In law, it is something else. She has just shared forty people's personal and financial details with a company, very likely on servers outside Kenya, for a purpose the parents never agreed to. Kenya's Data Protection Act governs every part of that, and schools are among the organisations Kenya's regulator requires to register whatever their size.

Most people who use AI at work have done something similar, and most have never heard that a law applies. This guide sets out the data protection act in each of the seven countries we cover, what they share, what they mean when you use AI tools, and the one habit that keeps you on the right side of all of them.

Every country we cover has a data protection law, and every one has a regulator. The details differ, especially on who must register, but the core ideas are close enough that one set of habits works across all seven.

In force since 25 November 2019, enforced by the Office of the Data Protection Commissioner (ODPC). Under the registration regulations, data controllers and processors must register unless their annual revenue is under KES 5 million and they have fewer than ten staff, but some sectors must register whatever their size, including schools, health providers, restaurants and hotels (Kenya Law, Business Daily).

In force since 3 May 2019, enforced by the Personal Data Protection Office (PDPO), part of NITA-U. Anyone who collects, processes, holds or uses personal data in Uganda must register, and registration is renewed every year (ULII).

In force since June 2023, enforced by the Nigeria Data Protection Commission (NDPC). Organisations the Commission classes as "of major importance" must register. A General Application and Implementation Directive, in force since 19 September 2025, sets out the registration duties and requires breaches to be reported to the Commission within 72 hours (Mondaq).

The oldest law of the seven, enforced by the Data Protection Commission. Data controllers must register, and renew (Data Protection Commission). An early draft of a revised law went out for consultation in October 2025 (US International Trade Administration).

In force since 1 May 2023, enforced by the Personal Data Protection Commission (PDPC). Anyone who collects or processes personal data must register (Afriwise).

The law on the protection of personal data and privacy, in force since 15 October 2021, enforced by the National Cyber Security Authority (NCSA). Data controllers and processors must register (DLA Piper).

The Protection of Personal Information Act of 2013 came into force on 1 July 2020 and has been enforced since 1 July 2021 by the Information Regulator. Organisations appoint an Information Officer and register them with the Regulator (DLA Piper, July 2021).

This is a summary to help you ask the right questions, not legal advice. Each regulator publishes its own guidance, and a local lawyer can tell you exactly what applies to your organisation.

None of these laws was written with ChatGPT in mind, but they did not need to be. They govern what you do with information about people, whatever the tool. Follow the bursar's list and you can see each rule apply in turn.

Purpose. The parents gave their numbers so the school could reach them about their children. Using those details for something else, such as feeding them to an AI tool, is a different purpose, and the laws limit that.

Security. Pasting the list copies it to a company's servers. Once it is there, the school no longer controls who sees it or how long it is kept, which is hard to square with the duty to keep personal data secure.

Sending data abroad. Most popular AI tools run on servers outside Africa. Kenya's Act allows personal data to leave the country only with proof of safeguards or on set grounds, and Kenya's High Court found in November 2023 that collecting and sending data abroad without meeting section 48 of the Act was unlawful (Kenya Law). Uganda's Act asks that the other country protect the data at least as well, usually with the person's consent.

People's rights. Under every one of these laws, people can ask what you hold about them and ask you to correct or delete it. That is very hard to honour once their details sit in a chatbot's history.

It would be easy to assume these laws exist on paper only. The record says otherwise, and the largest companies have not been exempt.

The Ugandan case is the clearest. On 18 July 2025 the Personal Data Protection Office found that Google LLC had broken the Act by not registering with the Office and by not showing the legal basis and safeguards for moving Ugandans' data abroad. It gave Google 30 days to register, name a data protection officer and submit evidence of its safeguards, and noted that Google could appeal (Business Times Uganda, 25 July 2025).

In Kenya, the ODPC has named sectors, among them schools, bars, restaurants and dispensaries, that must register whatever their size (Business Daily). In Ghana, the Data Protection Commission launched a Privacy Seal in December 2025 that organisations can earn and display (US International Trade Administration).

If a regulator will act against one of the largest companies in the world, a school or a shop that leaks a list of customers should not assume it will be overlooked.

You almost never need a person's details to get help from AI. The bursar does not need to paste the list. She needs one good reminder message, which she can then send to each parent herself.

1. Replace names with roles: "a parent", "Customer A", "the patient".
2. Remove phone numbers, ID numbers, addresses and account numbers.
3. Leave out health or money details that point to one person. Describe the situation instead: "a parent who owes part of this term's fees".
4. Ask the AI for a template or a draft, then fill in each person's details yourself, outside the tool.
5. Check your AI tool's data settings, and switch off the use of your chats for training where you can.

Write this down as a one-page rule for everyone who works with you, and find your country above to check whether you must register. If your website or app collects people's details, read what an AI website builder leaves out before you launch. And for how to get good work out of AI without handing it personal data, see how to use ChatGPT for your small business.

Why AI struggles with African languages, and what data changes
Why AI is weaker in your language, and the people building the data to fix it.

How to use ChatGPT for your small business
Brief it like a new helper, check it like a manager, and never paste a customer into it.