TanzaniaPersonal Data Protection Act, 2022, investigation, enforcement and offences
Personal Data Protection Act 2022 (Act No. 11 of 2022), Part VII (ss. 39-50, investigation and enforcement) and Part IX (ss. 60-64, offences and general penalty)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Personal Data Protection Commission
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Personal Data Protection Commission to investigate a complaint and to be able to issue an enforcement notice or an administrative penalty of up to TZS 100,000,000.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unlawfully obtaining, disclosing or offering for sale personal data is an offence carrying, for an individual, a fine of not less than TZS 100,000 but not exceeding TZS 20,000,000 or imprisonment for a term not exceeding ten years, or both, and for a company or corporation a fine of not less than TZS 1,000,000 but not exceeding TZS 5,000,000,000 (s. 60); unlawfully destroying, deleting, misleading, concealing or altering personal data carries a fine of not less than TZS 100,000 but not exceeding TZS 10,000,000 or imprisonment for a term not exceeding five years, or both (s. 61); and any other contravention of the Act with no specifically stated penalty carries a general penalty of a fine of not less than TZS 100,000 but not exceeding TZS 5,000,000 or imprisonment for a term not exceeding five years, or both (s. 63).
Penalty structure
The Commission's administrative penalty for a contravention of the Act is capped at TZS 100,000,000 (s. 47); separate criminal fines and imprisonment terms attach to specific offences.
- Rule
- Fixed only
- As of
- Currency
- TZS
- Fixed cap
- 100,000,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Part VII lets the Commission investigate a complaint, serve an enforcement notice and issue a penalty notice, and Part IX makes unlawful disclosure and unlawful destruction, deletion, concealment or alteration of personal data offences. None of these sections requires a controller to make or keep a log or record. Section 42(1)(e) and (3) let the Commission examine and copy books, documents and records and any recorded personal data held by a controller during an investigation, which is a power to demand what exists and is the row's own text. The preservation order in section 59 is outside this row.
- Kind
- None
- As of
What this law does
A person may complain to the Commission of a violation of the personal-data-protection principles, and the Commission may investigate, issue an enforcement notice, and impose an administrative penalty of up to TZS 100,000,000 for a contravention of the Act. A person aggrieved by the Commission's decision may appeal to the High Court.
Separate criminal offences attach to specific conduct: unlawfully selling or disclosing personal data, and unlawfully destroying, deleting, concealing or altering personal data, each carrying its own fine and imprisonment range, and any other contravention with no specifically stated penalty carries a general penalty.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .