Tanzania Personal Data Protection Act (Draft)

Per TZ PDPA: consent + notice + Collection Without Consent exceptions + sensitive data.

• TZ PDPA evidence for TANZANIA-2

• registration + PDPC partial

Per TZ PDPA: DPO + PDPC notification + breach notification + enforcement.

• TZ PDPA evidence for TANZANIA-5

• registration + PDPC partial

Organisations meeting the threshold criteria must appoint a Data Protection Officer with documented independence, suitable expertise, and direct reporting to senior management.

• Board minute appointing the DPO
• Position description with reporting line
• DPO contact details published internally and externally
• Conflict of interest declaration
• Annual DPO report to executive management

• DPO role bundled with CISO without independence safeguards
• DPO contact not registered with the Commission
• No annual report evidencing oversight

Controllers must maintain a current record of processing activities covering purposes, categories of data and subjects, recipients, transfers, retention, and security measures.

• Centralised RoPA spreadsheet or tooling export
• Quarterly attestation by business owners
• Change log showing additions and retirements
• Mapping of RoPA entries to systems and vendors
• RoPA extract submitted to the Commission on request

• RoPA last updated more than a year prior
• Owners not aware of their RoPA entries
• Marketing automation flows missing from inventory

High risk processing requires a documented impact assessment covering necessity, proportionality, risks to data subjects, and mitigating measures, with Commission consultation when residual risk remains high.

• DPIA template anchored to Tanzanian context
• Library of completed DPIAs with sign off
• Risk register entries linked to DPIA outputs
• Commission consultation submissions
• Annual review schedule

• No trigger criteria documented for when DPIA is required
• DPIA produced after launch
• Residual risk not escalated to executive sponsor

Personnel handling personal data must receive role appropriate training on the Act, the controller's privacy programme, and incident reporting.

• Annual privacy training deck
• LMS completion reports by team
• Role based deep dive modules for high risk teams
• Knowledge check results
• Awareness campaign evidence such as posters and newsletters

• Training not refreshed when regulations change
• Contractor population excluded
• No effectiveness measurement beyond attendance

Direct marketing communications require a lawful basis with clear opt out mechanisms, suppression lists, and respect for consumer preference signals.

• Marketing consent flags in CRM
• Unsubscribe link audit
• Suppression list extract and synchronisation evidence
• Channel level opt out workflow design
• Sample marketing message archive

• Cross brand marketing sending without renewed consent
• SMS suppression list not synced to email platform
• No double opt in for newly acquired lists

Controllers must operate an accessible complaints channel, log complaints centrally, and cooperate with Commission investigations and directives.

• Complaint policy with escalation steps
• Centralised complaint register
• Sample case files showing investigation steps
• Commission correspondence archive
• Director attestation of cooperation

• Multiple inboxes with no central register
• No log of Commission engagement
• Cases closed without root cause analysis

Controllers must operate a documented process to respond to access, correction, deletion, objection, and restriction requests within the statutory response window.

• Documented rights handling procedure
• Ticketing system extract with request type and closure dates
• Identity verification workflow
• Response letter templates in Swahili and English
• Quarterly metrics on response timeliness

• No identity verification step before disclosure
• Rights inbox not monitored on weekends
• Refusal reasons not logged with statutory citation

Privacy notices must disclose identity of the controller, purposes, lawful basis, retention, recipients, transfer destinations, rights, and Commission complaint route in plain language.

• Master privacy notice with section mapping to statutory requirements
• Layered notices for mobile and call centre channels
• Version control log
• Translation review of Swahili notice
• Customer facing point of capture screenshots

• Notice not provided at point of mobile sign up
• Swahili version trailing English by multiple versions
• Recipients listed only as categories with no examples

Decisions made solely by automated processing with significant effects on data subjects require safeguards, human review options, and explanations.

• Inventory of automated decision systems with personal data inputs
• Documented human review pathway
• Explanation templates for adverse decisions
• Model risk assessments
• Audit logs of overrides

• No record of model decisions affecting consumers
• Human review path not staffed adequately
• Explanations limited to generic phrasing

Per TZ PDPA: data subject rights including access + correction + erasure + portability.

• TZ PDPA evidence for TANZANIA-3

• registration + PDPC partial

Per Tanzania Personal Data Protection Act: scope + Duty to Register + Registration Application + lawful basis. Align with PDPC Tanzania.

• TZ PDPA evidence for TANZANIA-1

• registration + PDPC partial

Controllers must establish and document a lawful basis under the Act for every category of personal data processed, with consent, contract, legal obligation, vital interest, public function, or legitimate interest each requiring distinct evidence.

• Record of processing activities mapped to lawful basis
• Consent capture logs with timestamp and version
• Legal obligation register citing Tanzanian statutes
• Legitimate interest assessments
• Annual review minutes of lawful basis register

• Default reliance on consent for activities better grounded on contract or legal obligation
• No version history for consent text
• Legitimate interest balancing tests not documented

Data controllers and processors operating in Tanzania must register with the Personal Data Protection Commission, maintain a current registration certificate, and renew on schedule.

• Registration application package
• Issued registration certificate
• Renewal receipts and acknowledgements
• Internal calendar entries for renewal milestones
• Updates to registered processing scope filed with the Commission

• Subsidiaries processing data without separate registration
• Renewal lapses past the regulatory window
• Scope changes not refiled when new processing activities are launched

Certain categories of personal data may be subject to local storage expectations or sector specific localisation rules, requiring inventory of storage locations and mitigation plans.

• Storage location map by system
• Sector regulator correspondence on localisation
• Mitigation roadmap when storage is offshore
• Cloud region selection rationale
• Annual review of localisation status

• Cloud workloads in regions never reviewed against Tanzanian rules
• No mapping of sector specific localisation requirements
• Mitigation plans treated as one off rather than living documents

Per TZ PDPA: security + cross-border with PDPC approval.

• TZ PDPA evidence for TANZANIA-4

• registration + PDPC partial

Controllers and processors must apply technical and organisational measures proportionate to the risk, with documented standards covering access control, encryption, logging, and incident detection.

• Information security policy approved by the board
• Access control matrix mapped to systems holding personal data
• Encryption inventory for data at rest and in transit
• Log retention configuration and SIEM use case catalogue
• Penetration test reports and remediation tracker

• Encryption not applied to historical backups
• SIEM lacks use cases for personal data exfiltration
• Pen tests scoped to public sites only, missing internal systems

Notifiable personal data breaches must be reported to the Personal Data Protection Commission within the statutory window with a defined content set, and to affected data subjects when material harm is likely.

• Incident response plan with Tanzanian regulatory annex
• Breach register with severity scoring
• Submitted Commission notifications and acknowledgements
• Customer communications archive
• Post incident reviews

• No clear trigger for Commission notification clock
• Severity scoring relies on subjective judgement
• Customer notice not translated to Swahili

Processing of children's data and sensitive personal data requires heightened safeguards, parental consent or specific legal basis, and tighter access controls.

• Inventory of sensitive data flows including health, biometric, and political views
• Parental consent workflow evidence
• Age gating screenshots
• Role based access reports for sensitive datasets
• Annual review of sensitive data necessity

• No process to detect minors signing up for adult services
• Sensitive data accessible to broad analyst pools
• Health data combined with marketing data without justification

Personal data transfers outside Tanzania require evidence that the recipient jurisdiction provides adequate protection, or that contractual safeguards and Commission authorisation are in place.

• Transfer impact assessment library
• Inter company data transfer agreements
• Standard contractual clauses with addenda for Tanzanian law
• Commission authorisation letters for specific corridors
• Map of data flows by recipient country

• SaaS subprocessors in unassessed jurisdictions
• No localisation analysis for cloud regions
• Authorisations not refreshed when vendor footprint changes

Controllers must bind processors with contracts addressing scope, security, subprocessing, audit rights, and breach notification, and must monitor compliance throughout the engagement.

• Master processor agreement template aligned to the Act
• Vendor risk assessment file
• Subprocessor approval log
• Audit reports or attestations from processors
• Annual vendor review minutes

• Legacy vendors operating under pre Act contracts
• No record of subprocessor approvals
• Audit rights never exercised even on high risk vendors

Personal data must be retained no longer than necessary for the documented purpose, with secure disposal evidenced when retention expires.

• Retention schedule by record type
• Automated deletion job logs
• Certificates of destruction for physical media
• Backup expiry policies
• Annual disposal attestation

• Indefinite retention defaults in operational systems
• Backups outlive primary copies without controls
• No physical media disposal log for legacy storage