What data governance means (for a normal business)
Data governance is simply knowing what data you have, where it lives, who can use it and for what, and making sure that stays true when you add AI tools. The law already expects it: GDPR in Europe, Kenya's Data Protection Act, and similar laws in many other countries require you to protect personal data and use it only for agreed purposes.
Where AI creates new risks
- Copy-paste into consumer AI apps: data leaves your control, and personal plans may have different data terms from business plans.
- AI connected to your systems: an assistant with access to everything can show the wrong person the wrong record.
- Prompt injection: hidden instructions in an email or document can trick an AI agent into revealing or sending data.
- Shadow AI: staff signing up for new AI tools nobody has checked.
- Outputs: AI-generated summaries or emails can include personal data where it doesn't belong.
A simple data classification
| Class | Examples | AI use |
|---|---|---|
| Public | Website text, published prices, brochures | Any approved AI tool |
| Internal | Processes, non-sensitive plans, drafts | Approved business AI tools only |
| Confidential | Contracts, financials, supplier terms | Approved tools with business data terms; remove names where possible |
| Personal / sensitive | Customer IDs, phone numbers, health, payments | Only in systems designed for it, with access controls |
The practical checklist
- Choose approved AI tools and use their business plans, which typically offer stronger data terms and admin controls. Check the provider's terms on training and data retention.
- Write a one-page AI policy: what's allowed, what's not, and the data classes above.
- Turn on single sign-on and admin controls so you can add and remove users.
- Strip personal data before sending it to AI when the task doesn't need it (use initials or IDs instead of names and phone numbers).
- Give AI agents the least access they need, respect existing user permissions, and require approval for actions that send or delete data.
- Log what AI systems access and do, and review samples regularly.
- Update your privacy notice to reflect how you use AI with customer data.
- Train staff with real examples of what not to paste.
The goal isn't to stop people using AI, because they will anyway. It's to give them a safe, approved way that's easier than the risky one.
When you build AI into your own software
- Keep sensitive data in your own database and send the AI only what each request needs.
- Enforce the logged-in user's permissions before the AI sees any record.
- Consider self-hosted or regional models for highly sensitive data. See open-source AI vs ChatGPT.
- Treat documents and emails the AI reads as untrusted input.
- Test for data leaks before launch, the same way you test for bugs.
A quick self-assessment
- Do we know which AI tools our team uses?
- Do we have business agreements for them?
- Could we tell a customer exactly where their data goes?
- Can an AI system in our business see more than the person using it?
Good data governance makes AI adoption faster, not slower: when people know what's safe, they use AI confidently. A short policy, approved tools and least-privilege access cover most of the risk for a small business. We design AI chatbots, agents and integrations with privacy built in: permission-aware access, data minimisation and audit logs, for businesses in Kenya and worldwide.
See our AI automation service, or read what MCP is.
