The Office of the Data Protection Commissioner released draft notes on Artificial Intelligence (AI), Emerging Technologies and Privacy-Enhancing Technologies. The ODPC invited stakeholders to share comments and recommendations on the guidance notes.
The Guidance Note on Artificial Intelligence[1]
This Guidance Note translates statutory principles into the AI context. It requires compliance with the Data Protection Act (DPA).[2] Entities deploying AI are required to provide privacy notices for automated processing, prohibiting the repurposing of operational data for model training without a fresh legal basis and ensuring security against attacks. Entities using AI for impactful decisions must prohibit automated processing without human involvement; they must also inform data subjects and explain decision logic.[3]
Compliance is framed as a continuous obligation mapped across seven lifecycle stages. This includes; problem definition and design, data collection, model training, testing, deployment and integration, operation and decommissioning and disposal. The note also extends storage limitations and erasure obligations beyond raw datasets to include trained model weights and parameters that encode personal information. The note clarifies that the public availability of data does not provide a legal basis for processing it; this includes scraping web content for use to train models.[4]
The framework categorises specific applications as high-risk AI applications. This includes credit scoring, health diagnostics, biometrics, hiring tools, education monitoring and law enforcement analytics subjecting them to mandatory Data Protection Impact Assessments. The note in its annexes provides a twelve-point self-assessment checklist that outlines key compliance areas for entities deploying AI systems. There is also a risk determination matrix annexed to specify whether a mandatory Data Protection Impact Assessment must be completed before deployment.[5]
The Guidance Note on Privacy-Enhancing Technologies[6]
This Note provides data controllers, data processors, technology developers and deployers with practical guidance on the use of Privacy-Enhancing Technologies (PETs). The Note categorizes PETs across six major operational mechanisms: Transformation, Cryptographic Technologies, Statistical and Computational Privacy, Distributed Computation and data synthesis.[7]
The guidance maps PETs directly to statutory principles under the DPA. PET deployment must be in accordance with the rights established by the Act. Deployment of PETs is mandatory for high-risk processing such as financial services, healthcare and telecommunications. Therefore, the note annexes a guide for PET selection, the matrix pairs specific data processing objectives with recommended PETs and highlights the considerations to guide this decision.[8]
There is also a fourteen-point annex self-assessment checklist for entities deploying PETs to verify compliance prior to processing. This includes oversight of a Data Protection Officer, DPIA integration, re-identification risk assessments and compatibility assessments with data subjects. PETs must also be regularly reviewed and audited.[9]
The Guidance Note on Emerging Technologies[10]
The Guidance Note highlights that AI and Technology developers must implement security and privacy by design and default. They must build data subject rights interfaces into system architecture and ensure hardware defaults to the highest privacy settings. Vendors must register with the ODPC and execute binding Data Processing Agreements (DPAs) before handling personal data. Deployers have the duty to establish lawful basis for data collection or use and update privacy notices, they must ensure mandatory DPIA, appoint DPOs and manage cross-border data transfers.[11]
The Note establishes tier risk classification for biometric processing. Verification is the lowest risk; identification is a materially higher-risk and surveillance is the highest risk. Surveillance therefore is subject to strict constitutional necessity and proportionality tests. Systems such as employer fingerprint attendance cannot rely on consent due to power imbalance therefore in such cases non-biometric fallbacks must be used instead. Sensitive biometric data requires explicit legal bases, privacy notices and a total ban on commercial profiling of children in virtual environments. This is to be applied to Immersive technologies deployment as well.[12]
Agencies that rely on cloud services to store, process and transmit personal data must assess the adequacy of data protection. They must also implement contractual safeguards transfers, conduct DPIA and ensure a DPO is involved in migration decisions. Entities processing personal data in connection with critical national infrastructure, national security or strategic government functions should assess whether applicable law or policy imposes requirements that constrain cloud deployment options.[13]
The Note provides a fourteen-point compliance checklist outlining verification steps before launching any emerging technology. This includes registering as a data controller or processor and documenting valid legal basis under Section 30 for each processing operation.[14]
Footnotes
- ODPC, Guidance Note on Artificial Intelligence, 2026. ↩
- ODPC, Guidance Note on Artificial Intelligence, 2026, 10. ↩
- ODPC, Guidance Note on Artificial Intelligence, 2026, 11. ↩
- ODPC, Guidance Note on Artificial Intelligence, 2026, 22. ↩
- ODPC, Guidance Note on Artificial Intelligence, 2026, 34. ↩
- ODPC, Guidelines on Privacy-Enhancing Technologies, 2026. ↩
- ODPC, Guidelines on Privacy-Enhancing Technologies, 2026, 9. ↩
- ODPC, Guidelines on Privacy-Enhancing Technologies, 2026, 11. ↩
- ODPC, Guidelines on Privacy-Enhancing Technologies, 2026, 37. ↩
- ODPC, Guidance Notes on Emerging Technologies, 2026. ↩
- ODPC, Guidance Notes on Emerging Technologies, 2026, 9. ↩
- ODPC, Guidance Notes on Emerging Technologies, 2026, 17. ↩
- ODPC, Guidance Notes on Emerging Technologies, 2026, 13. ↩
- ODPC, Guidance Notes on Emerging Technologies, 2026, 39. ↩
English 
Swahili