TanzaniaPersonal Data Protection Act, 2022, transborder data flow
Personal Data Protection Act 2022 (Act No. 11 of 2022), Part V (ss. 31-32, transfer of personal data to states with and without adequate data protection)
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Before transferring personal data outside Tanzania, confirm the recipient country provides an adequate level of data protection or that another condition under sections 31-32 is satisfied.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 31(3) requires the controller to make a provisional evaluation of the necessity for a transfer of personal data to a country with adequate protection, and section 31(4) requires the recipient to ensure that the necessity can be subsequently verified, which cannot be shown without a record of the evaluation. The section names no contents, retention period, reviewer or person entitled to see the record, and section 32 on transfers to other countries adds no record duty.
- Kind
- Implicit
- As of
- Provision
- Personal Data Protection Act, 2022, s. 31(3) and (4)
- Trigger
- personal_data_processing
What this law does
Personal data may be transferred to a country with an adequate personal-data-protection legal framework where the recipient establishes that the transfer is necessary and can subsequently verify that necessity, and the data controller ensures the recipient processes the data only for the purpose for which it was transferred.
A transfer to a country without such a framework is permitted only where an adequate level of protection is otherwise ensured and the data is transferred solely to permit authorised processing.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .