Client data leaving Kenya: cloud and AI tools
What Kenya's Data Protection Act asks of a firm before client personal data is stored or processed abroad, including cloud storage and AI tools.
By Achekam · · 5 min read · For Accountants & audit firms in Kenya
Very little of a modern Kenyan practice's software runs only on a machine in the office. Files sit in a cloud drive, e-mail passes through an international provider, and a manager pastes a client's payroll summary into an AI assistant to draft a covering note. Each of those can move personal data outside Kenya, often without anyone deciding that it should.
The Data Protection Act does not forbid that. It does require the firm to have a basis for it, and to be able to show that basis if asked. This article explains the rule, the exposure if it is ignored, and the settings in Achekam that let a firm decide where client files and AI requests go.
The law behind the rule
The ODPC describes the Data Protection Act, 2019 as giving effect to Article 31(c) and (d) of the Constitution, establishing the Office of the Data Protection Commissioner, and setting the obligations of data controllers and processors. The ODPC lists the Act alongside the Data Protection (General) Regulations, 2021, the registration regulations and the complaints-handling regulations, all made in 2021, as Kenya's data protection framework.
Section 25: one principle among several
The transfer rule sits in section 25, in the list of data protection principles. Under that section, personal data must be:
- collected for explicit, specified and legitimate purposes;
- limited to what is necessary;
- kept accurate;
- kept no longer than necessary; and
- not transferred outside Kenya without proof of adequate safeguards or the data subject's consent.
Reading the transfer limb next to the others is useful. A firm that sends only what is necessary, for a stated purpose, has less to justify than one that uploads a whole client folder to a tool because it is convenient. The full text of section 25, and the rest of the Act on processing, data subjects' rights, breach notification and the Commissioner's powers, is on Kenya Law's page for the Data Protection Act.
Safeguards or consent
Section 25 gives two routes for a transfer: proof of adequate safeguards, or the data subject's consent.
Consent is harder to rely on than it sounds for an accounting firm. The data subjects are often not the client at all, but the client's employees, customers and suppliers, whom the firm never meets. Asking each of them is rarely practical.
That leaves safeguards, and the word "proof" matters. The firm should be able to point to something concrete for each service that holds client personal data outside Kenya: the provider's contractual terms, its security commitments, and the firm's own assessment that these are adequate. For higher-risk processing, a formal assessment may be appropriate; see data protection impact assessments in Kenya.
What the Act allows the Commissioner to fine
Section 63 caps an administrative fine at five million shillings or, for an undertaking, one per centum of its annual turnover for the preceding financial year, whichever is lower.
For most practices, the reputational cost of explaining to a client that its staff payroll was sent abroad without a basis will outweigh the fine.
Choosing where client files are kept in Achekam
Achekam lets a firm decide where its workspace's files are stored. A firm administrator can point the workspace's file storage at the firm's own S3-compatible bucket, SharePoint, OneDrive or Google Shared Drive, and copy existing files across.
That turns the storage question into one the firm answers for itself. It can choose a provider and configuration it has assessed, hold the contract directly, and keep the evidence of its safeguards assessment alongside its other data protection records.
AI requests: which vendor, with whose key
AI is the newer route by which client data travels. In Achekam, all AI features go through one AI engine that can use Anthropic, OpenAI, Google Gemini, DeepSeek or xAI. The engine uses the firm's own API key first, and the platform's key only where that is allowed. With no key at all, every AI feature says so and drafts nothing.
For a firm thinking about section 25, that design has three practical uses:
- The firm chooses the vendor. Using its own key means the firm holds the contract with the AI provider and can assess that provider's terms as it would any other processor.
- The firm can see what was sent where. The AI Activity Log lists every AI request with the vendor, the model, the tokens used and an estimated cost (the cost is an estimate from vendor list prices).
- The firm can stop it. A workspace administrator can switch AI off for the whole workspace, for example while the firm completes its assessment.
What the log and the switch do not do is make a transfer lawful. They give the firm the information and the control it needs to make the decision and record it. More on handling client data in AI tools is in AI and client data protection.
Engagement letter wording
Clients should not find out from a questionnaire that their data is processed abroad. A short paragraph in the engagement letter avoids that. It can say:
- which categories of the client's personal data the firm processes;
- which kinds of service the firm uses that may hold or process that data outside Kenya, such as cloud storage and AI drafting;
- the basis the firm relies on, usually its assessment of the providers' safeguards;
- that the client can ask for details of the providers used; and
- how the firm will tell the client if something goes wrong.
Keep the paragraph factual. It should describe what the firm does, not promise outcomes it cannot control.
A short review for the firm
| Question | Where to look |
|---|---|
| Where do our client files sit? | Achekam's cloud storage setting and any other drives in use |
| Which AI vendors receive client data? | The AI Activity Log |
| Do we hold the vendor contracts ourselves? | The firm's own API keys and storage accounts |
| Have we recorded why each is adequate? | The firm's data protection file |
| Do clients know? | The engagement letter |
A first step this week
Open the AI Activity Log and the storage setting and write down, in one page, which providers currently receive client personal data. That page is the start of the evidence section 25 asks the firm to be able to produce, and a natural companion to the firm's registration, covered in ODPC registration and fees for accounting firms.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
