TanzaniaPersonal Data Protection Act, 2022, security and breach notification
Personal Data Protection Act, 2022 (Act No. 11 of 2022), s. 27 (security of personal data)
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Protect personal data with security safeguards reasonable in the circumstances.
- If you are a data controller, notify the Personal Data Protection Commission without undue delay of any security breach affecting personal data processed by you or on your behalf.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 27(5) requires the controller to notify the Commission without undue delay of a security breach, and section 27(1) to (4) require security safeguards, a data protection officer and a processor contract. The section requires the controller to notify a breach and does not say to document it, and it imposes no log or record duty.
- Kind
- None
- As of
What this law does
A data controller must protect personal data with security safeguards reasonable in the circumstances, and must notify the Personal Data Protection Commission without undue delay of any security breach affecting personal data being processed by or on behalf of the controller. The Act sets no fixed notification deadline and imposes no separate statutory duty on the controller to notify the affected data subject directly.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .