TanzaniaPersonal Data Protection (Collection and Processing) Regulations, cancellation of registration, offences and complaints
Personal Data Protection (Personal Data Collection and Processing) Regulations 2023 (GN No. 449C of 2023), regs. 12 to 14, 34(4), 35 and 36 (cancellation, appeal, offences and complaints)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Personal Data Protection Commission
- Instrument type
- a regulation made under an act
- Obligation class
- Licensing, Governance
As of .
What it requires
- This binds a data controller or data processor.
- Comply with the Regulations, since a contravention is an offence liable to the penalty the Act stipulates (regulation 35).
- If the Commission gives notice that it intends to cancel your registration, give it reasons within seven days why the registration should not be cancelled (regulation 13(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Regulation 35 makes a contravention of the Regulations an offence liable on conviction to the penalty stipulated in the Personal Data Protection Act, 2022, and the Regulations set no penalty of their own.
What this law does
A person who contravenes the Regulations commits an offence and on conviction is liable to the penalty stipulated in the Act. A data subject or any interested person who is aggrieved or affected by processing, or by a decision relating to personal data, made contrary to the Act or the Regulations may submit a complaint to the Commission.
The Commission may cancel a registration after satisfying itself that the controller or processor gave false or misleading information, violated the terms and conditions of registration, repeated an offence, or refused to pay a fine within the time given. After receiving the Commission's notice of intended cancellation, a controller or processor must give reasons within seven days why its registration should not be cancelled.
A controller or processor aggrieved by a decision of the Commission may appeal in writing to the Minister within seven days from the date of the decision, and the decision of the Minister is final. The Commission conducts periodic audits to monitor compliance with the data protection impact assessment report and with any recommendations or instructions it has given.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.