Offshore artificial intelligence (AI) system providers face enhanced privacy safeguards under a new proposal aimed at holding them accountable for breaches of personal data abroad.

The Office of the Data Protection Commissioner (ODPC) has published a draft guidance note as it seeks to tighten scrutiny on the growing use of cross-border AI tools among firms such as banks and insurers.

The draft framework says firms must formalise relationships with vendors and ensure enforceable protections are in place before any data leaves Kenya. The proposal places new compliance demands on companies that export personal data for processing outside the country.

The ODPC said it has noted a trend in which AI services are frequently provided by offshore processors, and training data transferred to and processed in foreign jurisdictions without adequate data protection frameworks.

The regulator now wants formal contractual arrangements between local firms and offshore AI providers, with the agreements explicitly governing how personal data is handled once transferred.

“Entities shall assess and document the adequacy of data protection in any jurisdiction to which personal data is transferred in connection with AI processing and shall implement contractual or other safeguards including binding corporate rules or contractual clauses where adequacy cannot be established. Entities may not transfer personal data to offshore AI processors without a lawful transfer basis,” reads the draft note.

The provision effectively forces firms to embed privacy protections into their international data-sharing arrangements rather than relying on informal or ad hoc measures.

The draft guidance note adds that firms will be required to “enter into a written data processing agreement governing the vendor’s handling of personal data,” ensuring that offshore providers are legally bound to meet Kenya’s data protection standards.

The regulator says the responsibility for data privacy safeguards will rest with the local entity even when data processing is outsourced overseas.

“Entities deploying AI systems bear accountability for ensuring that the system complies with data protection law throughout its lifecycle,” reads the draft.

The proposals align with global trends, where regulators are tightening controls on AI and cross-border data flows to mitigate data privacy risks.

The move comes amid a surge in the use of global AI platforms in Kenya, many hosted in jurisdictions with differing data protection standards, raising concerns over how citizens’ data is stored, processed, and potentially reused.

The proposals could have wide-ranging implications, particularly for sectors such as finance, healthcare, and telecommunications, where AI-driven tools are increasingly used for customer analytics, fraud detection, and automation.

Financial firms such as banks and insurers are increasingly using AI for credit scoring, fraud detection and claims adjudication, while hospitals apply machine learning to diagnostic imaging as law enforcement agencies explore predictive analytics.

In addition, employers are turning to algorithmic tools to screen job candidates, as retailers and digital platforms deploy AI for personalised advertising and content recommendation.

“The volume of personal data being collected, aggregated, and fed into AI training pipelines and inference systems is growing exponentially. AI systems by their nature introduce novel data protection challenges that existing sectoral guidance has not fully addressed,” said ODPC.

Follow our WhatsApp channelfor the latest business and markets updates