Kenya regulator and Visa push tighter AI data safeguards

Kenya’s Office of the Data Protection Commissioner (ODPC) has released draft guidance that would require firms to formalise contracts with offshore artificial‑intelligence providers and embed enforceable privacy safeguards before any personal data leaves the country. The proposal mandates written data‑processing agreements, assessment of the adequacy of foreign data‑protection regimes, and places ultimate responsibility for data privacy on the local entity even when processing is outsourced.

Visa’s senior vice‑president for growth and partnerships, Rubail Birwadker, argues that enterprises need clear guardrails for “agentic” AI systems to protect privacy while unlocking value. He stresses the importance of trust, transparency and accountability, recommending contractual safeguards, human oversight for high‑risk decisions, and balanced autonomy to ensure compliance with regulatory and customer‑trust requirements.