The Tanzania Personal Data Protection Law came into effect on May 1, 2023, and the implementation results include the establishment of the Personal Data Protection Commission, which has the following responsibilities:
i. Overseeing the implementation of the Law;
ii. Registering data collectors and processors of personal information;
iii. Receiving, investigating, and addressing complaints regarding violations of personal data protection and individual privacy;
iv. Conducting research and monitoring technological developments related to data processing; and
v. Enhancing cooperation with other countries.
These Commission responsibilities adhere to major principles that all countries worldwide should follow to ensure the protection of individuals' personal information during the collection, processing, distribution, and storage of personal data. These principles include:
i. Legitimate and fair data collection
ii. Purposeful data collection
iii. Self-sufficient and institutionally-aligned data collection
iv. Accurate and timely data collection
v. Data retention for the appropriate period for the intended purpose
vi. Data collection respecting all rights of the data subject
vii. Data collectors or processors are responsible for protecting personal data
viii. Adhering to cross-border data transfer procedures
Since the establishment of the Personal Data Protection Commission, the following issues have been addressed:
PDPC Board of Directors
Establishment of the Personal Data Protection Commission Board consisting of seven (07) members led by the Chairman of the Board, Ambassador Adadi Mohammed Rajabu, and the Vice-Chairperson of the Board, Ms. Fatma Mohammed Ali, who were appointed by Her Excellency President Samia Suluhu Hassan. Following their appointment, the Minister of Information, Communications, and Information Technology, Hon. Nape Moses Nnauye, appointed other members including Mr. Ramadhan Athumani Mungi, Mr. Edward Samwel Lymo, Mr. Hamid Haji Machano, Ms. Frida Peter Mwera, and Mr. Maxcence Mello.
Regulations
Two (2) Regulations have been enacted under the mentioned Law;
First, The Personal Data Collection and Processing Regulations of 2023 through GN. 349 of May 12, 2023, specifies the registration procedure for Data Collectors and Processors of Personal Information; outlines the data subject's rights in the collection and processing of personal data concerning them; the procedure for the transfer of personal data outside the country; and imposes obligations on data collectors and processors, especially in ensuring the security standards during the collection and processing of personal data.
Second, The Procedures for Handling Complaints of Violations of Personal Data Protection Principles of 2023 through GN. 350 of May 12, 2023. These regulations outline the procedures for filing complaints against violations of personal data protection principles; the investigation and resolution procedures for submitted complaints; and the procedures for hearing complaints.
Data protection Guidelines
Four (4) Guidelines have been prepared, including the Guidelines for registering data collectors and processors, Guidelines for managing complaints, Guidelines for the Personal Data Protection Policy, and Guidelines for the Data Subject's Consent.
Structure and Responsibilities
The structure and division of responsibilities have been completed and approved, where the Commission will carry out its duties in Mainland Tanzania and Zanzibar on Union matters.
PDPC Head office
The Commission's Headquarters office is currently located at the Universal Communications Service Access Fund (UCSAF House) in Njedengwa, Dodoma, and there is a Zanzibar Commission Office on the Fourth (4th) floor of the Bombay Bazar Center Amani in the Amani roundabout area on the way to Kwerekwe. The Commission has acquired a 2.99-hectare plot in Njedengwa for the construction of the Commission's offices, and preparations for the construction have begun, including architectural drawings.
Registration Systems and Data Protection Handling Complaints Procedures
The Registration System for Data Collectors and Processors of Personal Information and Handling Complaints against Violations of Personal Data Protection Principles (RCMIS) has been completed. The RCMIS system is capable of performing the following functions:
- Identification and Registration of Data Controllers and Data Processors and issuance of registration certificates. (Registration module);
- Registration of Commission officials responsible for registration, including the registrar, approver, and all Commission officials involved in registration, as well as the registration of representatives of Data Collecting and Processing institutions;
- Payments through the Government electronic Payment Gateway (GePG);
- Receipt and issuance of public notifications (Notifications module);
- Issuance of permits for data crossing borders (Permit module);
- Compilation and issuance of quarterly reports on data protection by data collectors and processors of personal information (Reports module);
- Data rectification by data collectors and processors (Rectification module); and
- Receipt of complaints from the Data Subject. (Complaints module).
This Commission is a crucial entity in the country's economic development, especially in this era where the country's vision is towards a Digital Economy where information has become a vital commodity. To achieve digital economy reforms that respect people's privacy, dignity, and humanity to build trust among users of digital services and systems such as reading systems, the use of national identification numbers, housing identification systems, and integrated payment systems.
This Commission is essential in ensuring the interests of domestic and foreign investments are conducted efficiently and with the intended goals, as well as enhancing the country's security matters. Let all Tanzanians and our partners support this Commission to achieve Personal data protection in Tanzania. All of us have a keen interest of making sure we comply to the Law, regulations and Guidelines as provided.
