TanzaniaPersonal Data Protection Act, 2022, rights of data subjects
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- On a data subject's request, tell them whether you are processing their personal data, and describe the data, the purposes of the processing and the recipients it is or may be disclosed to.NIST Privacy FrameworkCT.PO-P3
- Suspend or do not begin processing a data subject's personal data when they require it because the processing is likely to cause substantial damage to them or to another person, unless an exception in the Act applies.NIST Privacy FrameworkCT.PO-P3
- Stop processing a data subject's personal data for direct marketing when they require it.NIST Privacy FrameworkCT.PO-P3
- Compensate a data subject who suffers damage from your contravention of the Act.
- Rectify, block, erase or destroy inaccurate personal data when the Commission orders it on a data subject's application, and notify the third parties you disclosed it to.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkCM.AW-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A person who contravenes a provision of the Act commits an offence and, where no penalty is specifically provided, is liable on conviction to a fine of not less than TZS 100,000 but not exceeding TZS 5,000,000 or imprisonment for a term not exceeding five years, or both (s. 63(1)); the court may also order forfeiture of the devices containing the personal data (s. 63(2)).
Penalty structure
The Commission's penalty notice for a contravention of the Act, including a breach of the data subject rights in Part VI, is capped at TZS 100,000,000 (s. 47). A separate criminal fine of TZS 100,000 to TZS 5,000,000 or imprisonment of up to five years applies under the general penalty in s. 63.
- Rule
- Fixed only
- As of
- Currency
- TZS
- Fixed cap
- 100,000,000
Who enforces it
Enforcement body
Personal Data Protection Commission, which may serve an enforcement notice on a person who has failed to comply with the Act (s. 45) and a penalty notice if the notice is not complied with (s. 46).
Settledness
- As of
- Open questions
- Does the entitlement to compensation in section 37(1) give a data subject a claim before a court, or only an application to the Commission under section 50(1)?
- Does section 37(1) apply without the conditions that section 37(2)(a) to (c) attach to the entitlement of a data subject whose rights have been infringed?
- Does a data controller's proof under section 50(3) that it is not in any way responsible for the event that caused the damage also defeat a claim under section 37(1)?
What it makes you log
Logging duty
Part VI (sections 33 to 35, 37 and 38) gives the data subject a right to be told whether data is processed, to stop or suspend processing and to compensation, and lets the Commission order rectification, blocking, erasure or destruction. None of those sections requires the controller to make, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 33 entitles a data subject to be told whether a controller is processing their personal data and to a description of the data, the purposes of the processing and its recipients. Section 34 lets a data subject require a controller to suspend or not begin processing that is likely to cause substantial damage. Section 35 lets a data subject require a controller to stop processing their personal data for direct marketing.
Section 37 entitles a data subject who suffers damage from any contravention of the Act to compensation from the controller or processor. Section 38 lets the Commission, on a data subject's application, order inaccurate personal data rectified, blocked, erased or destroyed, and requires the controller to notify the third parties it was disclosed to.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .