Personal Data Protection Legislation in Tanzania

Personal Data Protection Legislation in Tanzania The Parliament of Tanzania passed the Personal Data Protection Act on 01st November 2022 and the highlights are as follows: The Act is enacted in Swahili language. The official English version has yet to be published. The Act is applicable to Tanzania mainland and Tanzania Zanzibar for union matters only. The term Data is defined to mean ‘an individual whose personal data is being processed in adherence to the Act.’ The term Sensitive Personal Data is defined to mean, ‘information concerning DNA, children, crime, financial transactions of an individual and security or in case of processed information, such as tribes, political affiliation, religion, trade union membership, gender or health.’ The term Personal Data defined to mean: i.

Personal information concerning children, crime, conviction, security and biometric information of an individual; ii. Personal information about color, nature, nationality, tribe, religion, age or marital status of a given person; iii. Personal information about education, medical records, criminal record, employment or financial transaction; iv. Personal information about identification number, sign or any other information that introduces an individual; and v. Address, fingerprints or blood group of an individual.

The term Data Collector is defined to mean ‘a body corporate, person or public institution which either in association with other body or alone, determine the purpose and methodology of personal data collection.’ The aim of the Act (among others) is to prevent unauthorized collection and processing of personal data and to ensure collecting, use and processing of personal data adhere to the laws of Tanzania. The Act establishes the Data Protection Commission (the Commission) which is vested with mandate to enforce the Act. One of the roles of the Commission is to register all data collectors and processors. The Commission is required to establish and maintain the data collectors and processors register.

Once the person is registered by the Commission, the registration certificate shall be valid for five years subject to the right of the Commission to cancel the certificate prior to its expiry if there are valid reasons for doing so. After being registered by the Commission, all data collectors are required to collect such information direct from an individual concerned. Prior to such collection of data, the person should be informed of the use of such information which is being collected. Also, Data collectors and processors prohibited from collecting and processing personal sensitive information, save with the leave of an individual concerned. Personal data may be transferred to other jurisdiction provided that there is a credible legal system on personal data protection.

Individual may file a complaint to the Commission against a data collector or processor who has breached the principles of personal data protection for enquiry and order. Disclosure or use of personal data by an individual without prior consent of an individual whose data is being disclosed, may be penalized to a fine not less than TZS 100,000 and not more than TZS 20 million or imprisonment for a term not exceeding 10 years or both. If the offence is committed by a company, the fine shall be between TZS 1 million and TZS 5 billion. Also, there are other offences relating to sale of persona data and its penalties. Disclaimer The views expressed in this paper are those of the author only and should not be considered as an official interpretation, defamatory or interference of any legislation, laws or policies of any country including Tanzania.

The contents of this paper should not under any circumstances be reproduced or used without our express written consent. It should not be considered as a legal

advice to any of its recipient(s) and should not be relied upon without obtaining further legal advice. We accept no liability for any loss occasioned or suffered due to the contents of this paper.