Is It Safe to Use ChatGPT at Work? AI and Kenya's Data Protection Act

The short answer: Yes, if you use it carefully. ChatGPT, Claude and Gemini are safe for most work tasks, but under Kenya's Data Protection Act, 2019, your business is responsible for the personal data of customers and staff. Never paste ID numbers, phone numbers, health or money details. Replace names with labels, turn off model training, and give staff written rules.

Most Kenyan offices already have this problem. Someone in accounts pastes a customer list into ChatGPT to tidy it. Someone in HR asks Gemini to summarise a disciplinary letter. Nobody asked permission, because nobody knew they needed to. This guide explains what the law expects, what to stop doing today, and the simple rules we teach teams in our classes.

Is it safe to use ChatGPT at work?#

It is safe for work that contains no personal or confidential data, and risky for work that does. The tool is not the problem. The problem is what staff paste into it.

When you type into a public AI tool, the text goes to a company outside Kenya, is stored on its servers and, on some free settings, may be used to train future models. For a marketing caption, that does not matter. For a client's ID number, it does.

• Safe without changes: drafting a social media post, rewriting an email with no names, explaining a formula in Excel, planning a meeting agenda, brainstorming product names.
• Safe after you strip the details: summarising a complaint, drafting a reply to a supplier, checking a contract clause, analysing sales by region.
• Not for a public AI tool at all: medical records, payroll with names, ID and KRA PIN lists, M-Pesa statements, anything a contract says is confidential.

The same rule applies to Claude, Gemini, Copilot and Meta AI in WhatsApp. If you want to know what each tool is best at, see our comparison of ChatGPT, Claude, Gemini and Copilot for work.

What does Kenya's Data Protection Act say, in one minute?#

The Act protects information about people, and it makes the business that collects it responsible for how it is used. You can read the full text of the Data Protection Act, 2019 on Kenya Law. Four ideas matter for AI.

• Personal data: "any information relating to an identified or identifiable natural person". A name, an ID number, a phone number, a location or an online identifier all count.
• Sensitive personal data: a stricter category. It includes health status, ethnic origin, belief, biometric data, property details, marital status and family details, including the names of a person's children, parents or spouse.
• Data controller: the business that decides why and how personal data is used. If your staff paste customer data into an AI tool, your business is the controller and carries the responsibility, not the AI company.
• The Data Commissioner: the Office of the Data Protection Commissioner (ODPC) registers controllers, handles complaints and can issue penalty notices.

Two parts of the Act touch AI tools directly. Section 25 says personal data must be "limited to what is necessary" for the purpose, and "not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject". Most AI tools process your text outside Kenya. So the safest habit is simple: do not send personal data to them at all.

The second is the penalty. Under section 63, the Data Commissioner can fine up to Ksh 5 million or, for a business, up to 1% of the previous year's annual turnover, whichever is lower (Data Protection Act, 2019, as revised on Kenya Law, checked October 2026). For a small business, the larger cost is often the lost trust of a client who finds their details were shared.

Consent matters too. The Act defines consent as "express, unequivocal, free, specific and informed". A customer who gave you their phone number for a delivery did not agree to have it pasted into a chatbot.

What should staff never paste into an AI tool?#

Never paste anything that identifies a real person, plus anything confidential to your business or your clients. Print this list and put it beside the office printer.

• Identity numbers: national ID, passport, KRA PIN, NHIF or SHA numbers, staff numbers.
• Contact details tied to a name: a customer's name with their phone number, email or physical address.
• Money: M-Pesa statements, bank account numbers, card details, payslips, loan balances.
• Health: sick notes, medical reports, insurance claims, anything about a person's health.
• Family and personal life: next-of-kin details, children's names, marital status, religion, ethnic origin.
• Logins: passwords, PINs, one-time codes, API keys.
• Confidential business material: client contracts marked confidential, unpublished financial results, tender prices before submission, board papers.
• Photos and recordings of people: ID photos, CCTV stills, voice notes from customers.

How do you strip the identity but keep the task?#

Replace every real detail with a label before you paste, and put the real details back yourself afterwards. The AI only needs the shape of the problem, not the people in it. In our classes we call this "strip the identity, keep the shape".

Here is a real-looking request from an HR officer, before and after.

Before (do not send):
Summarise this warning letter for Jane Wanjiru Kamau, ID 2345xxxx,
of 14 Moi Avenue, who was absent on 3, 4 and 10 March because of
her pregnancy check-ups at Kenyatta Hospital.

After (safe to send):
Summarise this warning letter for Employee A. Employee A was absent
on three days in one month and gave a medical reason. Draft a fair,
neutral summary for the HR file, in plain English, under 150 words.
Use [date] where a date is needed.

The second prompt gets a summary just as good as the first. It contains no name, no ID number, no address and no health details. When the draft comes back, you add the real name and dates in your own document, not in the chat.

Three habits make this quick:

• Use consistent labels: Customer A, Customer B, Supplier 1, [amount], [date], [town].
• Round the numbers: "about Ksh 2 million in sales" is enough for most analysis.
• Paste the structure, not the records: for a spreadsheet, paste the column headings and three made-up rows, then ask for the formula. Run the formula on the real file yourself.

Which settings should you change in ChatGPT, Claude and Gemini?#

Turn off model training, use temporary chats for sensitive work, and keep work on work accounts. These settings take two minutes and every staff member should check them on day one. Menu names change often, so look for the words below.

• ChatGPT: Settings, then Data controls. Turn off "Improve the model for everyone". Use a Temporary Chat for anything sensitive; it is not saved to your history.
• Claude: Settings, then Privacy. Choose whether your chats may be used to help improve Claude. Use an incognito chat for one-off sensitive tasks.
• Gemini: open your Gemini activity settings and turn off activity saving if you do not want chats kept and reviewed. Use a temporary chat where it is offered.
• Copilot and Meta AI: check the privacy settings in the app, and treat anything typed into Meta AI in WhatsApp as leaving your phone.

Personal accounts or company accounts?#

Use company accounts for company work. When staff use their own free accounts, the business cannot see what was shared, cannot delete it, and loses it when the person leaves.

Paid business plans (ChatGPT Business or Enterprise, Claude Team or Enterprise, Gemini in Google Workspace, Microsoft 365 Copilot) say they do not use your business data to train their models by default, and they give an administrator control. Read the current terms before you buy. A business plan reduces the risk; it does not make personal data safe to paste.

What about chat history?#

Chat history is useful, because staff can return to a good answer. It also means sensitive text stays stored. Ask staff to delete any chat that contains something it should not, and to use temporary chats for anything borderline.

What are five simple AI rules for a team?#

Five rules cover most of the risk in a small business. These are the rules we give every team in the safe-use block of our AI training.

1. No real people in prompts. Use labels such as Customer A. If the task cannot be done without a real person's details, do not use a public AI tool for it.
2. Approved tools only. Name the AI tools staff may use for work, and on which accounts. Everything else needs a manager's yes.
3. A human checks before anything leaves. AI drafts, a person approves. Every figure, name, date and legal point is checked against the source before it goes to a client.
4. Say when AI did the heavy lifting. Tell your manager, and the client where the contract or the client expects it.
5. Report mistakes the same day. If someone pastes something they should not, they tell a named person, delete the chat and note what happened. No blame for reporting quickly.

Rule 3 matters as much as privacy. AI tools state wrong facts confidently. In class we show people how an answer can quote a law, a figure or a source that does not exist. A team that checks before sending protects its clients and its name.

Cloudwise Limited, an ICT company in Westlands, Nairobi, runs hands-on AI training on Claude for individuals and teams. The safe-use block is part of Day One of our courses, before anyone uploads a real document. Individuals get the same rules in AI Essentials, the one-Saturday course where you build your own AI assistant. For a first look at Claude on a free account, including what never to paste, read our beginner's guide to using Claude AI for free.

When do you need a written AI policy?#

You need one as soon as more than one person uses AI for work, which in most offices is now. A written policy turns good habits into the rules everyone follows, and it shows a client or the Data Commissioner that you took reasonable steps.

It does not need to be long. One page is enough if it covers:

• Purpose: why the business uses AI and for what kinds of work.
• Approved tools and accounts: which tools, on which accounts, set up by whom.
• Data never to share: the checklist above.
• Review before use: who checks AI output, and what they check.
• Disclosure: when staff tell a manager or a client that AI was used.
• Incidents: what to do the same day when something goes wrong.
• Owner: one named person who keeps the policy up to date.

Teams who train with us leave with an AI use policy template built for their own business. See AI training for teams, with a policy template for how the team sessions work.

Is this legal advice?#

No. This guide explains the Data Protection Act in plain words for everyday AI use. It is not legal advice. If your business handles health records, financial data or children's data, or you are unsure whether you must register with the ODPC, speak to a data protection lawyer or a data protection officer. The ODPC's own website lists its guidance, registration and complaints services.

Frequently asked questions#

Can I paste a client's ID number into ChatGPT?#

No. An ID number is personal data under the Data Protection Act, and your business is responsible for it. Pasting it into a public AI tool sends it outside your control and, often, outside Kenya. Replace it with a label such as "Client A, [ID]" and add the real number in your own document afterwards.

Do free AI accounts learn from my chats?#

They can, depending on your settings. Free ChatGPT, Claude and Gemini accounts each have a setting that controls whether your chats may be used to improve the models. Check it on day one and turn it off for work. Business plans usually exclude your data from training by default, but read the current terms.

Does a small business need an AI policy?#

Yes, if more than one person uses AI for work. A one-page policy is enough: approved tools, data never to share, who checks output, and what to do when something goes wrong. It is quick to write, protects your clients, and shows you took reasonable steps under the Data Protection Act.