Tanzania Data Protection Act 2022 and Regulations 2023

Data Protection Act 2022 and Regulations 2023 came into force in Tanzania on 1 May 2023.

Registration

• All data controllers / data processors shall be registered by the Personal Data Protection Commission (Commission) and be issued with registration certificates, renewable every 5 years.
• A person shall not collect or process personal data without being registered as a data controller or a data processor under this Act (Section 14(1)).
• A person who intends to collect or process personal data shall apply to the Commission for registration (Section 14(2)).
• Commission may, within a period specified in the regulations, grant or reject the application submitted under subsection (2) (Section 14(3)).
• Commission shall issue a certificate of registration to the data controller or data processor who has fulfilled the prescribed requirements and registered under this section (Section 14(4)).
• Where Commission rejects an application it shall inform the applicant in writing and give reasons for the decision (Section 14(5)).

Concepts

• Data controller – natural person / legal person / public body which alone or jointly with others determines the purpose and means of processing of personal data. Where the purpose and means of processing are determined by law, “data controller” is the natural person / legal person / public body designated as such by that law, or his / her representative.
• Data processor – natural person / legal person / public body which processes personal data for and on behalf of the data controller and under the data controller’s instruction, except for the persons who, under the direct authority of the data controller, are authorised to process the data, or his / her representative.
• Processing – analysis of personal data, whether or not by automated means, such as obtaining, recording or holding the data or carrying out any analysis on personal data, including:
  • organisation, adaptation or alteration of the personal data;
  • retrieval or use of the data; or
  • alignment, combination, blocking, erasure or destruction of the data.

Rights of data subjects

• Data subjects may apply to data controllers / data processors to have personal data erased, rectified or have the collection / processing suspended.

Transfer of personal data outside Tanzania

• Application for transfer permit to be made to PDPC before transfer is effected.

Data protection policy / officer

• Data controllers / data processors must put a policy / code of ethics in place and appoint a data protection officer who will, amongst other things, file quarterly compliance reports to PDPC.

Please contact VELMA Law if you have any comments or questions.