The rise of emerging technologies in Kenya

Kenya’s digital economy has grown exponentially in recent years. According to a Country Commercial Guide Report published by the International Trade Administration in late 2024, Kenya’s ICT sector expanded by an average of 10.8% annually over the past decade, with projections that the digital economy would contribute up to 9.24% of Kenya’s GDP by the end of 2025. This rapid growth has been driven by innovations in fintech, e-commerce, and digital service delivery, where businesses increasingly rely on vast datasets to tailor products, manage risks, and anticipate consumer needs. With the growing adoption of AI tools – both proprietary and open-source – organisations are increasingly processing personal data and sensitive personal data in complex ways.

For instance, AI models depend on vast amounts of data for training and improvement, including personal data (that is information about identified or identifiable natural persons) which is collected from consumers, users, or third-party sources. The risk lies in how that information is obtained, used, shared and stored. Without clear safeguards, the potential for privacy violations, discrimination or misuse of personal data becomes high.

Kenya’s legal framework

Kenya’s Data Protection Act, 2019 (DPA) was enacted to provide a framework for safeguarding individuals’ personal data and ensuring responsible data handling by both public and private entities. Since its commencement of operations as the government regulator under the DPA, the Office of the Data Protection Commissioner (ODPC) has been very active in its regulatory efforts including through conducting investigations, issuing penalties and promoting awareness about data protection matters across various sectors.

The DPA requires, among other things, that all personal data processing activities be carried out in a fair, lawful and transparent manner and that individuals be informed about how their personal data will be used. These principles apply equally to AI-driven systems to the extent that they are relied upon to process any personal data. Organisations deploying AI tools in Kenya must therefore ensure that all personal data processing activities are fair, lawful and transparent to data subjects and that automated decision-making processes do not infringe on privacy rights or lead to unfair treatment of data subjects

AI-generated intellectually property

The intersection between AI and IP is equally complex. Traditionally, IP law recognises human creativity: authors and inventors. Increasingly, however, creations that would traditionally fall within the scope of intellectual property – such as music, artwork and software code – are being generated by AI systems.

Globally, jurisdictions are grappling with whether AI can be recognised as an author or inventor. The general position remains that only human creators can author or be recognised as the creators of IP rights. In Kenya, the language of the Copyright Act and the Industrial Property Act takes for granted the incidence of human authorship and inventorship in every case. That means AI-generated outputs may in some cases fall outside the scope of traditional IP protection unless significant human creative input or direction can be demonstrated.

To this extent, businesses investing in AI-driven innovation, for example, automated content creation or generative design, must carefully assess whether outputs generated by AI systems are capable of protection under existing intellectual property regimes, particularly in light of the requirement for human authorship or inventorship. At the same time, such businesses must ensure that any prompts into AI systems, as well as the resulting outputs, do not infringe the intellectual property rights of third parties.

Balancing innovation and compliance

Companies are increasingly seeking and achieving significant monetization of data through analytics, partnerships or integration with AI solutions. However, where monetisation relates to personal data a careful consideration of (and effort to align with) the DPA’s principles must be made. The principle of purpose limitation is of particular significance. In practice, that means personal data collected for one purpose – for example, customer onboarding – cannot later be redirected for another purpose, for example, training of an AI tool without proper consent or a lawful basis. Organisations must also implement privacy-by-design principles, ensuring that AI systems incorporate mechanisms for the implementation of data protection principles and safeguards from the start.

For sectors like healthcare, insurance and finance – where personal and sensitive personal data are used to make high-impact decisions – ethical and legal compliance is not just a regulatory requirement; it is a competitive advantage. Consumers are increasingly aware of their rights as data subjects, and companies that demonstrate trust and transparency are more likely to earn their loyalty.

Building a responsible AI future

Kenya is taking steps towards creating a more coherent framework for emerging technologies. The government’s National AI Strategy 2025–2030, which was launched in early 2025, provides a comprehensive framework to harness AI’s transformative potential across various sectors and provides the context for ongoing discussions around digital policy. Collaboration between regulators, industry players and legal practitioners will be essential in shaping laws that encourage innovation while protecting rights.

While the process of development of a comprehensive legal framework for emerging technologies continues, businesses should take proactive steps to ensure compliance with existing laws, mitigate potential legal and ethical risks, and build trust through responsible and transparent use of technology. Such steps include:

• conducting AI impact assessments before deploying machine learning systems to determine the legal risks involved with the use of such systems;
• reviewing data protection policies and consents to ensure they cover AI use cases;
• auditing contracts and IP ownership structures where AI tools are being used in the development of IP works; and
• adopting ethical AI principles, including inclusivity and non-discrimination, transparency and accountability, and ethical and responsible AI as outlined in the National AI Strategy.

These steps not only ensure compliance with the DPA but also position businesses to compete responsibly in Kenya’s evolving digital economy.

Conclusion

There is general consensus on the fact that emerging technologies hold immense potential to drive Kenya’s economic growth, improve public services and empower local innovation. But as with any powerful technology, they carry risks that must be carefully managed. A forward-looking approach of combining strong data protection practices, clear IP ownership frameworks and ethical use of technology, will be crucial for ensuring that Kenya reaps the benefits of such technologies while safeguarding the rights and trust of its citizens