Processes personal data, in Tanzania

Personal Data Protection Act, 2022 (Act No. 11 of 2022), Part V (ss. 31-32, transfer of personal data to states with and without adequate data protection) · Read the law's page

• Before transferring personal data outside Tanzania, confirm the recipient country provides an adequate level of data protection or that another condition under sections 31-32 is satisfied.

Personal Data Protection Act, 2022 (Act No. 11 of 2022), Part VI (ss. 33-35, 37-38, rights of data subjects and compensation) · Read the law's page

• On a data subject's request, tell them whether you are processing their personal data, and describe the data, the purposes of the processing and the recipients it is or may be disclosed to.
• Suspend or do not begin processing a data subject's personal data when they require it because the processing is likely to cause substantial damage to them or to another person, unless an exception in the Act applies.
• Stop processing a data subject's personal data for direct marketing when they require it.
• Compensate a data subject who suffers damage from your contravention of the Act.
• Rectify, block, erase or destroy inaccurate personal data when the Commission orders it on a data subject's application, and notify the third parties you disclosed it to.

Personal Data Protection Act, 2022 (Act No. 11 of 2022), Part VII (ss. 39-50, investigation and enforcement) and Part IX (ss. 60-64, offences and general penalty) · Read the law's page

• Expect the Personal Data Protection Commission to investigate a complaint and to be able to issue an enforcement notice or an administrative penalty of up to TZS 100,000,000.

Personal Data Protection Act, 2022 (Act No. 11 of 2022), s. 27 (security of personal data) · Read the law's page

• Protect personal data with security safeguards reasonable in the circumstances.
• If you are a data controller, notify the Personal Data Protection Commission without undue delay of any security breach affecting personal data processed by you or on your behalf.

Personal Data Protection Act, 2022 (Act No. 11 of 2022), s. 30 (prohibition on processing of sensitive personal data) · Read the law's page

• Obtain the data subject's prior written consent before processing genetic, biometric or other sensitive personal data, including data related to a child, and where the data subject is a minor or otherwise unable to consent, seek that consent from a parent, guardian or other legal representative.

Personal Data Protection Act, 2022 (Act No. 11 of 2022), ss. 1-5, 14, 21-26 (principles, application and registration) · Read the law's page

• Process personal data lawfully, fairly and transparently, and only for an explicit and legitimate purpose.
• Register with the Personal Data Protection Commission before collecting or processing personal data.

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 12 to 14, 34(4), 35 and 36 (cancellation, appeal, offences and complaints) · Read the law's page

• This binds a data controller or data processor.
• Comply with the Regulations, since a contravention is an offence liable to the penalty the Act stipulates (regulation 35).
• If the Commission gives notice that it intends to cancel your registration, give it reasons within seven days why the registration should not be cancelled (regulation 13(2)).

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 15 to 18 (preventing processing, rectification, erasure and children) · Read the law's page

• This binds a data controller or data processor that receives an application from a data subject.
• When a data subject applies to prevent the processing of their personal data, acknowledge the application within seventy-two hours without charging a fee, temporarily suspend the processing and mark it as restricted on your system; then decide within seven days, giving written reasons if you reject it (regulation 15).
• When a data subject applies to rectify personal data, accept and rectify the data or reject the application within fourteen days, and give written reasons for a rejection (regulation 16).
• When a data subject applies to erase or destroy personal data, consider the application within fourteen days, and give written reasons for a rejection (regulation 17).
• Where the data subject is a child, properly identify the person exercising the right and inform the parent or guardian of the risks of processing and the protection in place (regulation 18(2)).

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 20 to 22 (permit to transfer personal data out of the country) · Read the law's page

• This binds a data controller or data processor that intends to transfer personal data outside Tanzania.
• Apply to the Personal Data Protection Commission for a permit on Form 7 before the transfer, with proof that the receiving country has ratified an international agreement on the protection of personal data, that an agreement between Tanzania and the receiving country covers it, or that a contract exists with the recipient (regulation 20).
• Keep to the conditions of the permit: transfer the data only to the recipient the permit authorises, process them only for the intended purpose, do not disclose or transfer them to another recipient without the approval of the Commission, and do not process them abroad in violation of the laws of the country (regulation 22).

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 23 to 25 (processing obligations, protection by design and lawfulness) · Read the law's page

• This binds a data controller or data processor.
• Collect and process personal data lawfully, fairly and transparently, for a legitimate and specified purpose, and only as far as it is adequate and necessary for that purpose (regulation 23(a) to (c)).
• Keep personal data accurate and up to date, and keep them in a form that permits identification of the data subject no longer than is necessary for the purpose of the processing (regulation 23(d) and (e)).
• In processing personal data, establish a personal data protection mechanism or design technical measures to safeguard and implement the principles of protection of personal data (regulation 24).
• In implementing the principle of lawfulness, consider whether the data subject understands what they consented to and has a simplified means to withdraw consent (regulation 25(d)).

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 23(g) and 27 (security of personal data), as amended by GN No. 808 of 2024 · Read the law's page

• This binds a data controller or data processor.
• Process personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against any loss, destruction or damage, using appropriate technical or organisational measures (regulation 23(g)).
• In implementing the principle of security, consider the factors regulation 27 lists, which include having in place procedures to detect, handle, report and learn from personal data breaches, keeping backups and logs to the extent necessary for security, using audit trails and events monitoring, regularly reviewing and testing software for vulnerabilities, and keeping sensitive personal data separate from the rest of the personal data (regulation 27, with paragraph (i) as replaced in 2024).

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 32 to 34 (data protection officer and impact assessment) · Read the law's page

• This binds a data controller or data processor.
• Appoint a data protection officer, who prepares and submits quarterly reports on compliance to the Personal Data Protection Commission (regulation 32).
• Before processing that is likely to affect the rights and freedom of the data subject, conduct a data protection impact assessment on Form 9; it covers, among other processing, automated decision-making with significant legal effect, biometric or genetic data, sensitive personal data relating to children or vulnerable groups, large-scale processing and innovative use of new technological or organisational measures (regulation 33).
• Where the assessment indicates a possible impact, request the instructions of the Commission and attach the assessment report; if the Commission gives none within thirty days after the report is submitted, you may continue with the processing (regulation 34).

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 4, 7, 8 and 10 (registration) · Read the law's page

• This binds a data controller or data processor, meaning anyone who collects or processes personal data. The Regulations have applied since 4 July 2023.
• Register with the Personal Data Protection Commission before you collect or process personal data, applying on Form 1 and paying the fee in the Second Schedule (regulation 4).
• Renew the registration by applying within the three months before it expires, since it is valid for five years; if you miss that period, apply for a new registration (regulations 7 and 8).
• Notify the Commission in writing within fourteen days after any change of the information entered in the register (regulation 10).

Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), reg. 5 · Read the law's page

• This binds every government institution and private entity, so it reaches any organisation that operates an information system. The Order has applied since 19 June 2026.
• Within six months from the commencement of the Order, assess your information systems with the checklist in the Second Schedule to determine whether any of them is critical information infrastructure (regulation 5(1)).
• Submit the self-assessment report to the Ministry responsible for Information and Communication Technology (regulation 5(2)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 (notification and reports) · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Notify the national CERT of any significant security breach to your systems or networks, meaning any circumstance or event having an adverse effect on their security such as a Denial of Service or Distributed Denial of Service attack, a Malware attack or a Botnet attack, together with the measures you undertook to resolve the security breach (regulation 7(f)).
• Share the key findings of each security assessment you perform with the National CERT as soon as possible (regulation 7(j)).
• Create and update a cybersecurity incidents register (regulation 7(n)).
• As a user of a computer or equipment with data processing capability, monitor your systems and networks in real time for security breaches and intrusions and report any breaches and intrusions to the Authority, and report to the Authority every quarter the implementation status of the security advisories it issues (regulation 11(e) and (f)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 as amended by GN No. 570 of 2023 · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Maintain a secure environment for your organization, Internet connectivity and internal network by maintaining updated systems that have a protection mechanism against information and computer security threats (regulation 7(a)).
• Maintain your organization's Information Communication Technology and cyber security policy for information and computer security (regulation 7(b)), and comply with the security standards, guidelines, minimum security specifications and minimum requirements the national CERT or your service providers recommend for securing your information and computer systems, or in response to threats or identified vulnerabilities (regulation 7(h), renamed 7(o) by the 2023 amendment).
• Engage licensed security penetration testers, and perform independent information security assessments at least once a year to know and apply remedial measures against your security weaknesses (regulation 7(h) and (i)).
• Protect your organization's domain names by applying secure protocols such as HTTPS and DNSSEC (regulation 7(k)).
• Establish, adopt and maintain policies, processes and procedures for managing cybersecurity incidents, implement a disaster recovery plan for restoring services after a cybersecurity incident or disaster, and create and update a cybersecurity incidents register (regulation 7(l) to (n)).
• As a user of a computer or equipment with data processing capability, perform vulnerability assessment and penetration testing of your network, systems and applications, perform security testing before any system or application moves into production, and fix identified vulnerabilities by applying patches or secure configuration (regulation 11(b) to (d)).
• As such a user, put in place documented security policies and procedures to mitigate all known risks associated with the services you offer, run cyber security awareness for your customers, and monitor and comply with the security standards and guidelines the Authority provides (regulation 11(g) to (i)).