Overview of The Personal Data Protection Act 2022 of Tanzania

By Sunday Ndamugoba and Lubaina Hassanali

Introduction

Data protection laws ensure that the privacy of citizens is upheld by protecting sensitive information from breach. The Personal Data Protection Act No.11 was introduced in 2022 and is applicable to Mainland Tanzania and Tanzania Zanzibar. The following are the objectives of that Act:

• Establish rules for the protection of personal data in both electronic and non-electronic forms;
• Minimize the collection and processing of personal data;
• Create a Commission for the protection of personal data;
• Promote data protection by government and private organizations;
• Introduces criminal sanctions for certain data breaches.

The Act informs on the establishment of the Commission and its framework, registration of data collectors and processors, procedures for data utilization and disclosure, conditions for the transfer of data abroad, rights of data subjects, measures for handling complaints and issuing fines, and financial framework for the Commission.  The Commission established under the Act, has several responsibilities, including monitoring and ensuring the implementation of data protection laws, registering collectors and processors, investigating and processing complaints, and acting against threats to personal data protection, these are further detailed in the Complaints Settlement Procedures Regulations, 2023 and Personal Data Collection and Processing Regulations, 2023.

Impact of The Personal Data Protection Act 2022 on Businesses

Businesses will be affected by the Act as it applies to any personal information held by organizations about their staff, customers, or account holders. Companies must secure and maintain accurate and up-to-date data while respecting the rights of individuals. The Act aims to build trust between businesses and customers by ensuring strong data protection. Businesses collecting and processing data must register with the Commission and obtain a certificate valid for five years, this will be discussed further below.

 

Download here the English version: The Personal Data Protection Act