DeepSeek and Chinese AI platforms in Africa: data sovereignty or technological dependency?
DeepSeek, Kimi and Baidu’s ERNIE chatbot are Chinese generative-AI platforms offering model services at low or no cost. Their rapid adoption by African governments and businesses raises questions about opaque data collection, China-based hosting and contractual control.
Severity
3Affected country
MASector
Public sectorPublished
6 November 2026
Our score measures operational relevance to Africa — not the global virality of the story.
Contents · 6
Rapid adoption in a contractual vacuum
Since early 2026, DeepSeek (DeepSeek-V3 and DeepSeek-R1) and Kimi (Moonshot AI) have experienced exponential adoption across Africa. The factors: completely free public versions, performance comparable to GPT-4o on many benchmarks, and a French-language interface.
At least four African ministries — including two in Morocco, one in Senegal and one in the DRC — have confirmed using DeepSeek in internal workflows, notably for report summarisation, legislative document translation and presentation generation. These uses have developed without formalised AI usage policies or risk assessments.
The data localisation problem
DeepSeek is a Chinese company subject to China's Cybersecurity Law (2017) and National Security Law (2015). These texts require Chinese companies to cooperate with national intelligence services on simple request, without adversarial judicial procedure.
Data entered into the DeepSeek interface — including sensitive documents uploaded for analysis — is transmitted to servers in China. DeepSeek's privacy policy specifies that data is stored "in the People's Republic of China."
For an African administration, this means that internal policy documents, budget data or negotiation files could be accessible to Chinese authorities without any bilateral data protection treaty applying.
Baidu ERNIE and the telecom operator expansion
In parallel, several African telecom operators linked to Chinese investments (notably Huawei and ZTE) have begun integrating Baidu AI models into their customer service platforms. In Kenya, Safaricom — where Vodacom (Vodafone) remains majority shareholder — has declined this option. But operators in Ethiopia, Zambia and Zimbabwe use Baidu components in their call-processing pipelines.
Concrete risks
Sensitive data exfiltration. Internal documents uploaded for translation or summarisation may contain strategic information (infrastructure plans, negotiating positions, citizen personal data).
Update dependency. Models hosted in China can be modified, censored or suspended without notice. An administration that has integrated DeepSeek into its workflows becomes dependent on infrastructure it does not control.
No DPA (Data Processing Agreement). DeepSeek does not offer a DPA compliant with GDPR or African data protection laws. Using DeepSeek to process citizen data likely constitutes a violation of Nigeria's NDPA, Senegal's Law 78-17, or GDPR for entities with European operations.
What African governments should do
— Publish an AI usage policy listing platforms authorised and prohibited for official data. — Require that any AI tool used for public data be hosted in jurisdictions with which a bilateral data protection agreement exists. — Evaluate sovereign options: open source models (Llama 3, Mistral Large) can be deployed locally on national infrastructure. — For low-sensitivity personal uses, the question is less critical — but training public servants on the risks is necessary.
The paradox of free
The free nature of these tools is precisely their danger: it bypasses normal procurement processes and enables informal adoption, outside any governance framework. In a context where African government IT budgets are tight, the temptation is strong. The real cost is deferred — and measured in lost sovereignty.
— ◆ —