What data protection law actually asks of an AI system

Compliance conversations about AI start with documentation and end with a policy nobody reads. The obligations that bite are engineering decisions, cheapest to make at the start.

Know what you are processing and why

Both regimes rest on purpose limitation and data minimisation: what personal data does the system read, on what lawful basis, and why each field? Training on a full record set because selecting fields was harder is avoidable.

Automated decisions need a route to a human

Where a decision that significantly affects someone is automated, there is generally a right not to be subject to it without safeguards: a real review path, built into the product, where the reviewer can disagree.

Design for the rights you will have to honour

Access, correction, export and erasure are easy in a clean schema and hard when personal data is scattered across a warehouse, a cache, a vector index and three training snapshots. Keep an inventory that includes derived stores.

Cross-border transfer is the hard constraint

Transfers out of Kenya need adequate protection or appropriate safeguards; under GDPR the question applies in reverse. It is solvable with contractual safeguards, regional processing or the self-hosted pattern above, but cheaper to decide before you build.