TanzaniaPersonal Data Protection (Collection and Processing) Regulations, security of personal data and breach procedures
Personal Data Protection (Personal Data Collection and Processing) Regulations 2023 (GN No. 449C of 2023), regs. 23(g) and 27 (security of personal data), as amended by GN No. 808 of 2024
In force since .
A breach notification rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a data controller or data processor.
- Process personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against any loss, destruction or damage, using appropriate technical or organisational measures (regulation 23(g)).
- In implementing the principle of security, consider the factors regulation 27 lists, which include having in place procedures to detect, handle, report and learn from personal data breaches, keeping backups and logs to the extent necessary for security, using audit trails and events monitoring, regularly reviewing and testing software for vulnerabilities, and keeping sensitive personal data separate from the rest of the personal data (regulation 27, with paragraph (i) as replaced in 2024).
These lines are LexLint's reading of the law's text, as of .
What this law does
A controller or processor must ensure that personal data are processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against any loss, destruction or damage, using appropriate technical or organisational measures. In implementing the principle of security of personal data, a controller or processor must consider a list of factors set out in regulation 27.
One of the factors is having in place procedures to detect, handle, report and learn from personal data breaches. Other factors are keeping backups and logs to the extent necessary for the security of personal data, and using audit trails and events monitoring as routine security controls. Another factor is regularly reviewing and testing software to uncover vulnerabilities of the systems supporting processing. Government Notice 808 was published on and amends the Regulations.
It replaced the factor in paragraph (i) of regulation 27 with a factor to keep sensitive personal data separate from the rest of the personal data.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.