TanzaniaPersonal Data Protection (Collection and Processing) Regulations, permit to transfer personal data out of the country
Personal Data Protection (Personal Data Collection and Processing) Regulations 2023 (GN No. 449C of 2023), regs. 20 to 22 (permit to transfer personal data out of the country)
In force since .
A cross border transfer rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Transfer, Licensing
As of .
What it requires
- This binds a data controller or data processor that intends to transfer personal data outside Tanzania.
- Apply to the Personal Data Protection Commission for a permit on Form 7 before the transfer, with proof that the receiving country has ratified an international agreement on the protection of personal data, that an agreement between Tanzania and the receiving country covers it, or that a contract exists with the recipient (regulation 20).
- Keep to the conditions of the permit: transfer the data only to the recipient the permit authorises, process them only for the intended purpose, do not disclose or transfer them to another recipient without the approval of the Commission, and do not process them abroad in violation of the laws of the country (regulation 22).
These lines are LexLint's reading of the law's text, as of .
What this law does
A controller or processor that intends to transfer personal data outside the country must apply to the Commission for a permit on Form 7. The applicant must submit proof that the receiving country has ratified an international agreement on the protection of personal data, that an agreement between Tanzania and the receiving country covers it, or that a contract exists with the recipient outside the country.
The Commission considers the application within fourteen days after receiving it and may accept or reject it. A permit is subject to four conditions: the data go only to the recipient the permit authorises, are processed only for the intended purpose, are not disclosed or transferred to another recipient without the approval of the Commission, and are not processed abroad in violation of the laws of the country.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.