TanzaniaPersonal Data Protection Act, 2022, application to processing of personal data
In force since .
A personal data rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Register with the Personal Data Protection Commission and have a lawful basis before collecting or processing personal data through a crawler or data pipeline, whether or not the data was publicly accessible online.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 22 states where Part IV applies and requires a lawful purpose, and no unlawful means, for collecting personal data. It imposes no duty to create, keep, produce or review a log or record. The Act's other provisions on records sit outside the section this row cites: section 28 on retention and disposal of personal data, section 29(2) on not deleting the prior text of a document once corrected, and section 15 on the Commission's register of controllers and processors. Section 22(1)(c) also applies Part IV to processing in Tanzania by a controller not domiciled there; that limb turns on where the processing takes place and carries no hook value.
- Kind
- None
- As of
What this law does
The Personal Data Protection Act, 2022 applies to any collection and processing of personal data performed wholly or partly by manual or automated means, by a controller domiciled in Tanzania or otherwise reached by the Act, with no carve-out for personal data that is otherwise publicly accessible.
Scraping personal data from a public Tanzanian website therefore remains subject to the Act's registration, lawful-basis, and cross-border-transfer duties, and biometric data is a sensitive personal data category carrying a heightened prior-written-consent requirement.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .