TanzaniaPersonal Data Protection Act, 2022, sensitive personal data
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Obtain the data subject's prior written consent before processing genetic, biometric or other sensitive personal data, including data related to a child, and where the data subject is a minor or otherwise unable to consent, seek that consent from a parent, guardian or other legal representative.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 30(1) allows sensitive personal data to be processed only with the data subject's prior written consent, so a written consent exists for every such processing, and section 30(2) lets the data subject withdraw it at any time. The section does not say how long the consent record is kept, who may ask for it or who checks it.
- Kind
- Implicit
- As of
- Provision
- Personal Data Protection Act, 2022, s. 30(1) and (2)
- Trigger
- consent_or_optout
What this law does
Sensitive personal data, defined to include genetic data, data related to children, data related to offences, financial transactions, security measures and biometric data, may not be processed without the data subject's prior written consent, which may be withdrawn at any time without explanation or charge.
The Minister may by regulation determine circumstances in which the prohibition cannot be removed even with the data subject's consent, and where the data subject is a minor, a person of unsound mind, or another person unable to consent, consent must instead be sought from a parent, guardian or other legal representative.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .