AI Privacy and Technology Compliance in East Africa
Personal data, artificial intelligence and intellectual property now meet in ordinary business decisions. This training article compares the East African legal landscape and explains how a lawyer can turn those risks into workable controls.
Contents
Why privacy compliance is now a business
duty
The East African legal map is similar
but not uniform
A data breach is a legal event, not only
an IT problem
AI contracts need human responsibility
What Kenyan and Ugandan cases teach
lawyers
Dissenting judgments are practical risk
maps
What a lawyer should put in place
The practical compliance rule
Personal data is now part of almost every
ordinary transaction. A mobile number collected for delivery, an employee
medical record, a customer photograph, a voice note saved in a cloud account
and a prompt entered into an artificial-intelligence tool can all create legal
responsibility. This article is a practical training guide for businesses,
public bodies and lawyers working across the East African Community.
It focuses on three connected risks:
privacy and data protection, technology and cybersecurity, and
intellectual-property or contract problems caused by AI-assisted work. The
comparison is deliberately practical. It asks what the law protects, what evidence
a lawyer should preserve, what arguments have worked in decided cases and what
a client should do before a dispute arrives.
Why privacy compliance is now a
business duty
A customer list, employee file,
mobile-money record, medical form, voice note or cloud folder is not “just
information”. It can identify a person, expose a family, affect employment or
reveal a business secret. Once an organisation collects it, the organisation
has to be able to explain why it needed the information, who may see it, where
it is stored and what happens when something goes wrong.
The same is true of artificial
intelligence. A staff member who pastes a customer complaint into an online
tool may disclose personal information. A manager who accepts a
machine-generated contract may sign terms that were never checked. A designer
who publishes an AI-assisted logo may discover that it resembles somebody
else’s mark. The technology is new, but the legal questions are familiar:
authority, purpose, consent, fairness, confidentiality, ownership and proof.
For that reason, privacy, technology and AI
compliance should be treated as a legal training subject, not an IT project
alone. The lawyer’s value is to connect the technical event to a duty, a remedy
and a defensible record. A good compliance file should show what the
organisation knew, what it decided, why the decision was proportionate and what
it did to reduce harm.
The East African legal map is similar
but not uniform
Kenya anchors privacy in Article 31 of the
Constitution and gives it operational detail through the Data Protection Act
2019 and the Data Protection Regulations of 2021. The registration, complaints
and enforcement regulations matter in practice because they turn broad duties
into questions about controllers, processors, notices, complaints and
accountability. The Computer Misuse and Cybercrimes Act 2018, the Copyright Act
and the Trade Marks Act also become relevant when a breach, an AI tool or a
copied brand is involved.
Uganda’s constitutional protection is in
Article 27, supported by the Data Protection and Privacy Act 2019 and the 2021
Regulations. Tanzania protects privacy through Article 16 of its Constitution
and now has the Personal Data Protection Act 2022 and accompanying regulations.
Rwanda’s Constitution protects privacy in Article 22, while Law No. 058/2021
Relating to the Protection of Personal Data and Privacy is administered through
the data protection authority and its guidance. Rwanda’s National AI Policy also
shows why an organisation should not wait for a special AI Act before putting
human oversight in place.
The remaining EAC Partner States require a
more careful country-by-country answer. Somalia has a Data Protection Act 2023
and a Data Protection Authority. Burundi adopted Law No. 1/03 of 10 March 2026
on the protection of personal data, making its compliance position materially
different from earlier regional comparisons. In the Democratic Republic of the
Congo, the Constitution protects private life, domicile, correspondence and
communications, but a business should not assume that EAC membership supplies a
single comprehensive data-protection code. It must check sector rules,
telecommunications and cyber rules, contracts and the current national
position. South Sudan likewise has constitutional and policy-level privacy and
cybersecurity concerns, but current comparative sources do not show a fully
operational comprehensive personal-data statute. A Ministry privacy policy is
not the same as an Act of Parliament.
This unevenness is the first practical
lesson. An organisation operating in Nairobi, Kampala, Kigali and Dar es Salaam
cannot safely use one form and call the exercise complete. The EAC Data
Governance Policy Framework is useful for regional direction and common
standards, and the Treaty and the East African Court of Justice provide a
regional rule-of-law setting. But there is not yet a single EAC privacy
regulator or a settled body of EACJ judgments deciding AI-generated contracts.
National constitutional rights, national statutes and the facts of the
transaction still control the advice.
The same caution applies to intellectual
property. Copyright and trade-mark protection remain principally national, with
different filing systems, evidence rules, remedies and enforcement offices. A
lawyer should identify the country in which the mark will be used, the country
in which the work was created, the countries where customers will see it and
the law chosen in the contract. “East Africa” is a useful business description;
it is not, by itself, a complete legal answer.
A data breach is a legal event, not
only an IT problem
A breach may be an attack, a lost laptop,
an email sent to the wrong person, an exposed cloud folder, an employee’s
misuse of access or an AI supplier retaining prompts that contained
confidential information. The first legal task is to establish facts without
destroying evidence. Who accessed what? When? Was the information encrypted?
Which people are affected? Is the organisation a controller, a processor or
both in different parts of the event?
The next task is to compare the event with
the applicable law. Kenya, Uganda, Tanzania and Rwanda each require
organisations to take privacy, security and accountability duties seriously,
but the details of notices, regulator engagement, contracts and sanctions are
not identical. Somalia and Burundi now require the same kind of disciplined
attention. In DRC and South Sudan, the absence of a single comprehensive
statute does not make careless disclosure safe; constitutional rights, sector
regulation, employment duties, confidentiality clauses, consumer protection and
cybercrime rules may still create exposure.
A lawyer helps by building a breach
protocol before the crisis. That protocol should name the decision-maker,
preserve logs, separate confirmed facts from assumptions, identify affected
jurisdictions, protect legally privileged communications where appropriate and
set a timetable for regulator and data-subject communications. It should not
promise that every incident will be hidden or that every incident must be
announced in the same words. A disclosure must be accurate, proportionate and
legally timed. Guessing can cause as much damage as delay.
The lawyer should also audit ordinary
practices: whether staff collect more information than they need, whether old
files are deleted, whether processors can use data for their own training,
whether access rights are reviewed, whether cross-border transfers have a
lawful basis and whether privacy notices match what the business actually does.
A beautifully written Privacy Policy cannot cure a system that secretly keeps
everything forever. The document and the real workflow must tell the same
story.
Terms of Service deserve the same care.
They should explain the service in plain language, define user
responsibilities, address acceptable use, identify ownership of user material,
control subcontracting and cloud storage, set out suspension and termination
rights and provide a workable complaint route. A term saying “the company may
do anything with your data” is unlikely to be a substitute for lawful, fair and
transparent processing. In a consumer or employment setting, excessive consent
language may also be vulnerable because the person has little real choice.
AI contracts need human responsibility
Most East African businesses are governed
by existing contract, privacy, employment, consumer, evidence, copyright and
trade-mark law even when an AI-specific statute is not yet in force. The
absence of a special AI Act is therefore not a licence to delegate legal
judgment to a chatbot. A generated clause can be wrong, incomplete or
inconsistent with mandatory national law. A machine may produce confident words
without knowing whether the signatory has authority or whether the promised
service is lawful.
An AI-related contract should identify the
human owner of the decision. It should say what tool may be used, what
information may not be entered, whether prompts and outputs are retained,
whether the supplier may train on them, how a human reviews an output, how
errors are corrected and what happens after a security incident. It should deal
with confidentiality, ownership, licences, warranties, audit rights,
subcontractors, cross-border transfers, indemnities, jurisdiction and
termination. Where a supplier claims that its tool is “secure”, the lawyer
should ask for evidence and a clear allocation of responsibility rather than
repeat the marketing language.
The evidence of human work matters
especially where copyright is claimed. In Aryeh Movement Limited v Cynthia
Beldina Akoth Okello, Copyright Tribunal Case COPTA/E001/2025, the Kenyan
Tribunal’s reasoning is a warning that a claimant must be able to show human
creative choices and not merely point to machine output. The safe lesson is not
that every AI-assisted work is unprotected. It is that prompts, drafts, editing
history, commissioning terms, selection decisions and final human revisions can
become decisive evidence of authorship and originality.
The same discipline protects trade marks.
An AI-generated name or logo must be searched before it is used, cleared
against confusingly similar marks and filed in the correct national system. A
lawyer also checks whether an image or font was supplied under a licence,
whether a person’s likeness was used and whether the output imitates a
competitor. Registration is not the end of enforcement; the owner must keep
evidence of use, monitor infringement and act through the appropriate national
office or court.
What Kenyan and Ugandan cases teach
lawyers
The Kenyan decision in Nubian Rights Forum
& 2 Others v Attorney General & 6 Others; Child Welfare Society & 9
Others (Interested Parties), Constitutional Petitions 56, 58 and 59 of 2019
(consolidated), [2020] eKLR, is a leading lesson in proportionality. The
dispute concerned the proposed National Integrated Identity Management System
and the collection of very sensitive personal and biometric information. The
petitioners’ legal team connected the programme to Article 31 privacy, the
risks to children and marginalised people, the need for necessity and
proportionality, and the absence of sufficient safeguards. The Government could
point to a legitimate identification purpose, but the High Court held that
implementation could not proceed without an appropriate comprehensive legal and
regulatory framework.
The advocacy lesson is precise pleading.
The case did not depend on saying that technology is frightening. It depended
on showing what information would be collected, why it was intrusive, what
could go wrong, which safeguards were missing and what order the court could
practically make. A lawyer who brings only an abstract fear of databases may
lose credibility. A lawyer who maps the data flow, identifies the
constitutional right and asks for a tailored suspension, declaration or
safeguard has given the court a workable route to protect people without
pretending that public administration has no legitimate purpose.
Uganda’s Constitutional Court decision in
Hon. Fox Odoi & 21 Others v Attorney General & 3 Others, Consolidated
Constitutional Petitions 14, 15, 16 and 85 of 2023, [2024] UGCC 10, gives a
different but useful privacy lesson. The Court upheld most of the
Anti-Homosexuality Act 2023 but struck down particular provisions, including
the reporting duty, after examining their effects on privacy, health and other
rights. For a lawyer, the practical point is to plead the offending provision
and its real consequence, and to ask for severance where that is the principled
remedy. An argument that insists the court must either destroy an entire
statute or do nothing may leave a narrower, stronger rights argument unused.
Regulatory enforcement also shows why
registration and transparency should be checked early. A 2025 decision reported
by Uganda’s Personal Data Protection Office in Ssekamwa Frank & 3 Others v
Google LLC treated data-protection compliance as an enforceable responsibility
rather than a voluntary public-relations promise. The lesson for counsel is to
verify who is processing the data, whether the organisation is registered where
required, what notice and lawful basis were used, and whether the client can
produce records supporting its account. A lawyer should never wait for a
complaint to discover that the client cannot identify its own processor.
These cases also explain how a client can
lose. It may have a good moral complaint but no evidence of actual processing.
It may file a broad claim without identifying the legal duty. It may ask the
court to decide ownership of AI content without preserving the human creative
record. Or it may publish a breach statement before the facts are checked.
Legal representation is not simply forceful language; it is the careful
conversion of facts into a remedy that the law recognises.
Dissenting judgments are practical
risk maps
A dissenting judgment does not normally
change the binding result, but it can be one of the most useful documents in
training and compliance. A dissent often isolates the point at which a majority
has accepted a government purpose, an evidential assumption or a limitation of
rights. That reasoning helps a lawyer ask a business question before
litigation: what information would answer the dissent’s concern, and what
safeguard would make the decision more defensible?
In privacy work, a dissent may warn that a
broad power permits future uses not tested in the present case, that oversight
is too weak, or that affected people cannot realistically challenge an
automated decision. Counsel should cite such reasoning honestly as persuasive
analysis, not as the holding. It can guide contract drafting, a regulator
submission, a constitutional petition or a request for interim protection. It
can also become important if a later court, legislature or regulator revisits
the issue.
The East African AI case law is still
developing and does not yet provide a single regional dissent that settles
AI-generated contracts or authorship. That absence is itself a training point.
Lawyers should not wait for a judge to announce every safeguard. They should
build a record now: data maps, impact assessments, approval chains, human
review notes, vendor terms, prompt restrictions, incident logs and evidence of
creative contribution. Compliance designed only around the current majority may
satisfy today’s minimum; compliance that answers the strongest dissent is more
likely to survive tomorrow’s case.
What a lawyer should put in place
The first deliverable should be a short
data and technology risk register. It should list the categories of personal
data, the people affected, the purpose, the system or supplier involved, the
countries touched, the retention period, the security control and the person
accountable. The register gives management a picture of risk that a Privacy
Policy alone cannot provide.
The second deliverable is a matched
document set: Privacy Policy, Terms of Service, employee and contractor
confidentiality terms, processor agreements, AI-use rules, incident response
plan, intellectual-property clearance checklist and a schedule for review. Each
document should fit the actual business. A small training provider may need
strong rules for student records and recordings; a fintech may need payment,
identity and fraud controls; a media company may need a careful chain of title
for text, images, voices and marks.
The third deliverable is training that
ordinary staff can use. Tell people not to paste identity documents, medical
information, client instructions or confidential contracts into an unapproved
AI service. Tell them how to report a suspected breach, how to check an
attachment and when to ask legal or security staff for help. Test the plan with
a short exercise. A policy that nobody understands is decoration, not
compliance.
Finally, make the review regional. For
every new country, confirm the constitutional right, the data statute and
regulations, the regulator, registration duties, breach procedure, transfer
rules, copyright and trade-mark route, court or tribunal and language of the
required notice. Record the date checked. Laws and policies change faster than
a printed manual, and a dated legal review is evidence that the organisation
took its duty seriously.
The practical compliance rule
The simplest rule is this: do not collect,
generate, sign, publish or disclose what the organisation cannot explain.
Explain the purpose, the authority, the human decision-maker, the security, the
owner and the remedy. If the answer is unclear, pause the process and obtain
advice. That habit protects customers and employees, reduces avoidable disputes
and gives a court or regulator something better than an after-the-fact promise.
Across East Africa, the legal systems are moving at different speeds, but the direction is clear. Privacy is a constitutional value; personal-data statutes are becoming more detailed; regulators are becoming more visible; and AI is testing old rules about consent, responsibility, evidence and authorship. A lawyer who joins those points together does more than draft a policy. The lawyer helps the organisation make technology answerable to people.
Sources Mentioned in This Training Article
Constitution of Kenya, Article 31; Data
Protection Act 2019 and Kenya Data Protection Regulations 2021; Computer Misuse
and Cybercrimes Act 2018; Copyright Act and Trade Marks Act. Constitution of
Uganda, Article 27; Data Protection and Privacy Act 2019 and Regulations 2021;
Copyright and Neighbouring Rights Act; Trade Marks Act. Constitution of the
United Republic of Tanzania, Article 16; Personal Data Protection Act 2022 and
regulations; Cybercrimes Act; Copyright and Neighbouring Rights Act; Trade and
Service Marks Act. Constitution of Rwanda, Article 22; Law No. 058/2021
Relating to the Protection of Personal Data and Privacy; Rwanda National AI
Policy; Law on the Protection of Intellectual Property. Constitution of
Burundi; Law No. 1/03 of 10 March 2026 on the Protection of Personal Data.
Somalia Data Protection Act 2023 and Data Protection Authority materials.
Constitution of the Democratic Republic of the Congo and applicable privacy,
communications and cyber rules. Transitional Constitution of the Republic of
South Sudan and applicable cybersecurity and sector rules. East African
Community Treaty and EAC Data Governance Policy Framework. Nubian Rights Forum
& 2 Others v Attorney General & 6 Others; Child Welfare Society & 9
Others (Interested Parties), [2020] eKLR. Hon. Fox Odoi & 21 Others v
Attorney General & 3 Others, [2024] UGCC 10. Aryeh Movement Limited v
Cynthia Beldina Akoth Okello, Copyright Tribunal Case COPTA/E001/2025. Ssekamwa
Frank & 3 Others v Google LLC, Personal Data Protection Office, reported
2025 enforcement decision.
Suggested Citation
Ronald Serwanga, “AI Privacy and Technology Compliance in East Africa,” East Africa Legal Insight (23 September 2026).