AI and Data Protection in Kenya: Lessons from the Worldcoin Judgment

October 5, 2026

Introduction

Artificial intelligence is now part of everyday work in Kenya. Businesses use AI tools to draft documents, summarise files, screen customers and analyse records. These tools save time, but they also create real legal risk when sensitive, restricted or confidential information is fed into them without proper safeguards.

Kenyan courts have already shown how seriously they treat the misuse of personal data by technology platforms. The clearest example is the High Court’s 2025 judgment against Worldcoin, a decision every organisation using AI should understand.

The Case: The Worldcoin Judgment (High Court, 5 May 2025)

On 5 May 2025, Justice Roselyne Aburili of the High Court at Nairobi delivered judgment in judicial review proceedings brought by Katiba Institute and the International Commission of Jurists (ICJ Kenya) against Worldcoin and its affiliated entities, with the Office of the Data Protection Commissioner (ODPC) participating in the matter.

Worldcoin, a digital identity and cryptocurrency project backed by Tools for Humanity, used a device called the Orb to scan the irises and faces of Kenyans in exchange for cryptocurrency tokens. This is biometric data, which the Data Protection Act, 2019 classifies as sensitive personal data.

The court found that Worldcoin:

Processed sensitive personal data without first conducting a Data Protection Impact Assessment (DPIA).
Collected personal data without valid registration with the ODPC under section 18 of the Act.
Obtained consent that was not free or voluntary, because tokens were offered in exchange for the data.
Transferred personal data outside Kenya in breach of section 48 of the Act.

The court held that these failures violated the right to privacy under Article 31 of the Constitution. It ordered Worldcoin to stop collecting and processing biometric data in Kenya and to permanently erase the data already collected within seven days, under the supervision of the Data Protection Commissioner. The ODPC later confirmed that the deletion had been carried out.

What Kenyan Law Requires

The Worldcoin decision applies principles that bind every data controller and data processor in Kenya, whether or not AI is involved.

Article 31 of the Constitution protects every person’s right not to have information relating to their family or private affairs unnecessarily required or revealed.
Section 25 of the Data Protection Act requires personal data to be processed lawfully, fairly, for explicit purposes, and kept secure.
Section 31 requires a DPIA where processing is likely to result in high risk to the rights of data subjects.
Section 35 gives every person the right not to be subject to a decision based solely on automated processing, including profiling, where it significantly affects them.
Section 41 requires data protection by design and by default.
Section 43 requires a data controller to notify the Data Commissioner of a qualifying breach within 72 hours of becoming aware of it.
Sections 48 to 50 restrict the transfer of personal data, and especially sensitive personal data, outside Kenya.

Under section 63, the Data Commissioner may impose administrative fines of up to KES 5 million or 1% of annual turnover, whichever is lower. Professionals who hold privileged information, such as advocates, also owe duties of confidentiality under the Evidence Act and their professional codes.

Where AI Creates Risk

The lesson from Worldcoin goes beyond biometric scanners. Any AI tool becomes a risk when restricted or confidential information is handled without legal safeguards. Common examples include:

Uploading client files to public AI tools. Contracts, medical records, financial statements or case files pasted into a free chatbot may be stored or processed on servers outside Kenya, raising cross border transfer concerns under section 48.
No lawful basis or consent. Using customer data to train or test an AI system for a purpose the customer never agreed to may breach the purpose limitation principle in section 25.
Skipping the DPIA. Deploying AI for credit scoring, recruitment or facial recognition without assessing the risks repeats the very failure the court condemned in Worldcoin.
Fully automated decisions. Rejecting a loan or job application through AI alone, with no human review, may infringe section 35.
Loss of privilege and confidentiality. Feeding privileged communications into an external platform may expose information that the law and professional ethics require to be protected.

Practical Safeguards

Organisations can use AI responsibly by building data protection into how they adopt it:

Register with the ODPC where required, as a data controller or data processor.
Carry out a DPIA before deploying any AI system that handles sensitive or large volumes of personal data.
Adopt an internal AI policy that sets out which tools are approved and what information must never be entered into them.
Review vendor terms to confirm where data is stored, whether it is used to train models, and how it is protected.
Anonymise or remove identifying details before using AI to analyse documents wherever possible.
Keep a human in the loop for decisions that significantly affect individuals.
Prepare a breach response plan that meets the 72 hour notification timeline.
Train staff so that every team member understands their obligations.

Conclusion

The Worldcoin judgment sends a clear message: innovation does not excuse non compliance. Kenyan courts will enforce consent, impact assessments and limits on data transfers, and they are prepared to order the destruction of unlawfully held data. As AI becomes part of daily operations, organisations that put data protection first will protect both their clients and their reputation.

Olinga Advocates advises clients on data protection compliance, AI governance and engagement with the Office of the Data Protection Commissioner.