Makes public services decisions, in Tanzania

Personal Data Protection Act, 2022 (Act No. 11 of 2022), ss. 33(1)(c) and 36 (automated decision making) · Read the law's page

• When a data subject requires it, ensure that a decision significantly affecting them is not based solely on automatic processing; where such a decision is made, notify them as soon as practicable and reconsider it if they ask, unless the decision is necessary for a contract with them, authorised by written law, or based on their explicit consent.
• Tell a data subject the logic involved where automatic evaluation of matters relating to them is, or is likely to be, the sole basis of a decision significantly affecting them.

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), reg. 19 (rights in relation to automated decision making) · Read the law's page

• This binds a data controller or data processor that takes a decision significantly affecting a data subject solely by automatic means.
• Notify the data subject in writing about the processing, stating basic information about it and its intended purpose, the effects likely to arise and how they will be handled, how the personal data are stored, and their right to object to the use of their personal data in commercial advertisements (regulation 19(1) and (2)).
• Respect the data subject's right to reject the use of their personal data in the decision made by automatic means (regulation 19(3)).

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 32 to 34 (data protection officer and impact assessment) · Read the law's page

• This binds a data controller or data processor.
• Appoint a data protection officer, who prepares and submits quarterly reports on compliance to the Personal Data Protection Commission (regulation 32).
• Before processing that is likely to affect the rights and freedom of the data subject, conduct a data protection impact assessment on Form 9; it covers, among other processing, automated decision-making with significant legal effect, biometric or genetic data, sensitive personal data relating to children or vulnerable groups, large-scale processing and innovative use of new technological or organisational measures (regulation 33).
• Where the assessment indicates a possible impact, request the instructions of the Commission and attach the assessment report; if the Commission gives none within thirty days after the report is submitted, you may continue with the processing (regulation 34).

Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), reg. 5 · Read the law's page

• This binds every government institution and private entity, so it reaches any organisation that operates an information system. The Order has applied since 19 June 2026.
• Within six months from the commencement of the Order, assess your information systems with the checklist in the Second Schedule to determine whether any of them is critical information infrastructure (regulation 5(1)).
• Submit the self-assessment report to the Ministry responsible for Information and Communication Technology (regulation 5(2)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 (notification and reports) · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Notify the national CERT of any significant security breach to your systems or networks, meaning any circumstance or event having an adverse effect on their security such as a Denial of Service or Distributed Denial of Service attack, a Malware attack or a Botnet attack, together with the measures you undertook to resolve the security breach (regulation 7(f)).
• Share the key findings of each security assessment you perform with the National CERT as soon as possible (regulation 7(j)).
• Create and update a cybersecurity incidents register (regulation 7(n)).
• As a user of a computer or equipment with data processing capability, monitor your systems and networks in real time for security breaches and intrusions and report any breaches and intrusions to the Authority, and report to the Authority every quarter the implementation status of the security advisories it issues (regulation 11(e) and (f)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 as amended by GN No. 570 of 2023 · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Maintain a secure environment for your organization, Internet connectivity and internal network by maintaining updated systems that have a protection mechanism against information and computer security threats (regulation 7(a)).
• Maintain your organization's Information Communication Technology and cyber security policy for information and computer security (regulation 7(b)), and comply with the security standards, guidelines, minimum security specifications and minimum requirements the national CERT or your service providers recommend for securing your information and computer systems, or in response to threats or identified vulnerabilities (regulation 7(h), renamed 7(o) by the 2023 amendment).
• Engage licensed security penetration testers, and perform independent information security assessments at least once a year to know and apply remedial measures against your security weaknesses (regulation 7(h) and (i)).
• Protect your organization's domain names by applying secure protocols such as HTTPS and DNSSEC (regulation 7(k)).
• Establish, adopt and maintain policies, processes and procedures for managing cybersecurity incidents, implement a disaster recovery plan for restoring services after a cybersecurity incident or disaster, and create and update a cybersecurity incidents register (regulation 7(l) to (n)).
• As a user of a computer or equipment with data processing capability, perform vulnerability assessment and penetration testing of your network, systems and applications, perform security testing before any system or application moves into production, and fix identified vulnerabilities by applying patches or secure configuration (regulation 11(b) to (d)).
• As such a user, put in place documented security policies and procedures to mitigate all known risks associated with the services you offer, run cyber security awareness for your customers, and monitor and comply with the security standards and guidelines the Authority provides (regulation 11(g) to (i)).