TanzaniaPersonal Data Protection Act, 2022
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Process personal data lawfully, fairly and transparently, and only for an explicit and legitimate purpose.NIST Privacy FrameworkGV.PO-P1
- Register with the Personal Data Protection Commission before collecting or processing personal data.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 14(1) bars collecting or processing personal data without registering with the Commission, and section 5 sets out the principles; neither requires a controller to make, keep or produce a log or record. The register itself is kept by the Commission under section 15, which this row does not cite. Section 22(1)(b) applies Part IV to a controller domiciled in the United Republic, so the establishment hook is read from the row's own text. Section 22(1)(c), which reaches a non-domiciled controller when the processing is in the United Republic, turns on where the processing takes place and gives no hook value, so it is left out.
- Kind
- None
- As of
What this law does
The Personal Data Protection Act, 2022 establishes the Personal Data Protection Commission and requires every data controller or processor to process personal data lawfully, fairly and transparently, collected for explicit, specified and legitimate purposes.
A person may not collect or process personal data without first registering as a data controller or data processor with the Commission, and public institutions that collect or process personal data are deemed registered from the Act's commencement. The Act applies to Mainland Tanzania and to Tanzania Zanzibar, except that in Zanzibar it does not reach non-union matters.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .