TanzaniaPersonal Data Protection (Collection and Processing) Regulations, procedures for data subject requests
Personal Data Protection (Personal Data Collection and Processing) Regulations 2023 (GN No. 449C of 2023), regs. 15 to 18 (preventing processing, rectification, erasure and children)
In force since .
A data subject rights rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Data subject rights
As of .
What it requires
- This binds a data controller or data processor that receives an application from a data subject.
- When a data subject applies to prevent the processing of their personal data, acknowledge the application within seventy-two hours without charging a fee, temporarily suspend the processing and mark it as restricted on your system; then decide within seven days, giving written reasons if you reject it (regulation 15).
- When a data subject applies to rectify personal data, accept and rectify the data or reject the application within fourteen days, and give written reasons for a rejection (regulation 16).
- When a data subject applies to erase or destroy personal data, consider the application within fourteen days, and give written reasons for a rejection (regulation 17).
- Where the data subject is a child, properly identify the person exercising the right and inform the parent or guardian of the risks of processing and the protection in place (regulation 18(2)).
These lines are LexLint's reading of the law's text, as of .
What this law does
When a data subject applies to prevent the processing of their personal data, the controller or processor must within seventy-two hours, without charging a fee, acknowledge receipt, temporarily suspend the processing and indicate on the system that the processing is restricted. Within seven days from the temporary suspension, the controller or processor must consider the application and may accept it, or reject it if it is of the opinion that the application is unreasonable.
A controller or processor that rejects the application must notify the applicant in writing and explain the reasons for the rejection. A controller or processor must, within fourteen days after receiving an application to rectify personal data, accept and rectify the data or reject the application. A controller or processor that rejects an application to rectify personal data must notify the data subject in writing and give reasons.
A controller or processor must, within fourteen days, consider an application to erase or destroy personal data. A controller or processor that rejects an application to erase or destroy personal data must notify the data subject in writing and give the reasons for the rejection. Where the data subject is a child, the controller or processor must ensure that the person exercising the right is properly identified.
The controller or processor must also ensure that the parent or guardian of the child is informed of the risks of processing and the protection in place.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or serves under-18s.