Walk around any office in Nairobi and you'll find someone asking an AI chatbot to tidy up an email, summarise a report or draft a reply to a difficult client. That's a good thing. These tools are genuinely useful.
The problem is what goes into them. A complaint letter with the client's name and phone number. A beneficiary list. A staff member's sick note. Once it's pasted in, it sits on servers your organisation doesn't control, often outside Kenya, and you can't take it back.
Where the risk actually is
The risk isn't that the AI is up to something. It's that staff paste in whatever is in front of them, because that's the quickest way to get help. Nobody stops to think that the text includes a national ID number.
Depending on the tool and the plan you're on, what you type may be stored, reviewed by the provider's staff, or used to train future models. Free personal accounts are usually the least protective.
Paste the problem, not the person.
What Kenyan law expects
Kenya's Data Protection Act, 2019 doesn't mention chatbots, but its rules still apply. Your organisation must only use as much personal data as it needs for the purpose, keep it secure, and send it outside Kenya only when the right safeguards are in place.
Pasting a client's details into an AI tool is sharing their data with another company. If that wasn't necessary, or the tool doesn't meet those safeguards, your organisation is responsible, not the person who pasted it.
Swap the details, keep the task
You almost never need real details to get a good answer. Describe the situation instead:
| Instead of pasting | Paste this |
|---|---|
| Reply to REDACTED, ID ID NUMBER, about her late rent. Her number is PHONE. | Reply to a tenant who is two months behind on rent. Polite, but firm about the deadline. |
| The full beneficiary spreadsheet, so the AI can "clean it up". | The column headings and three made-up rows, so it can show you the formula. |
| A staff member's medical note. | An employee needs two weeks of sick leave. Draft a supportive HR reply. |
Try it yourself
This is the idea behind Tando, a browser extension I'm building. Type something with personal data in it and see what an AI chatbot would receive instead.
Type a message. See what Tando hides before an AI chatbot reads it.
Five habits for your team
- Use work accounts, not personal ones.
Check whether your plan uses your chats to train the AI, and switch that off where you can.
- Strip names, ID numbers, phone numbers and emails before you paste.
Placeholders like [CLIENT] or [TENANT] work just as well.
- Never paste health, children's or financial details.
These are the most sensitive kinds of personal data and need the most care.
- Treat the answer as a draft.
Check facts and figures before anything goes out with your organisation's name on it.
- Write it down.
A one-page AI use policy tells staff what's allowed, so they don't have to guess.
When to bring in your DPO
If an AI tool is going to handle personal data as a regular part of someone's job, for example screening applications or answering client messages, that's no longer a quick question. You may need a data protection impact assessment before you start.