TanzaniaPersonal Data Protection (Collection and Processing) Regulations, data protection officer and impact assessment
Personal Data Protection (Personal Data Collection and Processing) Regulations 2023 (GN No. 449C of 2023), regs. 32 to 34 (data protection officer and impact assessment)
In force since .
A comprehensive regime rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- DPIA, Governance, Reporting
As of .
What it requires
- This binds a data controller or data processor.
- Appoint a data protection officer, who prepares and submits quarterly reports on compliance to the Personal Data Protection Commission (regulation 32).
- Before processing that is likely to affect the rights and freedom of the data subject, conduct a data protection impact assessment on Form 9; it covers, among other processing, automated decision-making with significant legal effect, biometric or genetic data, sensitive personal data relating to children or vulnerable groups, large-scale processing and innovative use of new technological or organisational measures (regulation 33).
- Where the assessment indicates a possible impact, request the instructions of the Commission and attach the assessment report; if the Commission gives none within thirty days after the report is submitted, you may continue with the processing (regulation 34).
These lines are LexLint's reading of the law's text, as of .
What this law does
A controller or processor must appoint a data protection officer. The data protection officer's duties include preparing and submitting quarterly reports on compliance to the Commission. Where processing is likely to affect the rights and freedom of the data subject, the controller or processor must conduct an impact assessment before carrying out the processing.
The assessment covers, among other processing, automated decision-making with significant legal effect, processing of biometric or genetic data, processing of sensitive personal data relating to children or vulnerable groups, large-scale processing of personal data and innovative use of new technological or organisational measures. The controller or processor conducts the assessment on Form 9.
Where the results of the assessment indicate a possible impact on the processing, the processor must request the instructions of the Commission and attach the assessment report. If the Commission gives no instructions within thirty days after the report is submitted, the processor may continue with the processing.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes biometric data or serves under-18s.