EXTENSION OF REGISTRATION FOR COMPANIES UNDER DATA PROTECTION LAW IN TANZANIA

In a bid to safeguard privacy and personal security in Tanzania, the Government on 1st November 2022 enacted the Personal Data Protection Act, 2022 (the Act) which came into force on 1st May 2023. The Act aims to regulate the collection, processing, storage,and utilization of personal information, ensuring that individuals’data is handled responsibly and securely. Furthermore, on 12th May 2023, the Minister for Information, Communication, and Technology published the Personal Data Protection Regulations (theRegulations). The two regulations issued were (i) The Data Protection (Collection and Processing of Personal Data) Reg ulations,GN No. 349 of 2023, and (ii) The Data Protection (ComplaintsHandling Procedure) Regulations, GN No. 350 of 2023.

Following the publishing of the Regulations, on 3rd April 2024, the Government launched the Personal Data Protection Commission (PDPC). Among the responsibilities of PDPC include, among others, implementing the Personal Data Protection Act,2022; registering data collectors and processors; receiving, investigating, and addressing complaints regarding violations of personal data protection and individual privacy, etc.

The Regulations require data collectors and processors (individuals, companies, institutions, public and private organizations) that process and hold the personal data of Tanzanian citizens to register with PDPC. The Act defines “personal data” to include name,identification number or mark, location data, colour, nationality or tribe, religion, age, or marital status of an individual, education,medical history, crime, or employment, address, fingerprint or blood.

The Regulations require data collectors and processors (individuals,companies, institutions, public and private organizations) thatprocess and hold the personal data of Tanzanian citizens to register with PDPC. The Act defines “personal data” to include name identification number or mark, location data, colour, nationality or tribe, religion, age, or marital status of an individual, education,medical history, crime, or employment, address, fingerprint or bloodgroup of an individual, and any other personal or confidential information. To put the above into perspective, employers (as data collectors) qualify for registration with PDPC as they collect and keep.

However, to ensure all data collectors and processors have been registered in compliance with the law, the PDPC vide the Public Notice has extended the registration deadline date to 30th April 2025. Based on PDPC’s notice, there will be no further extension granted. Failure to register with PDPC may lead to significant penalties and other heavy measures outlined in the Act.

Given the deadline of 30th April 2025, we highly encourage businesses to be proactive and fulfill their legal obligations by registering with PDPC. Failure to register with PDPC may attract heavy penalties and strict enforcement measures as outlined in the Act.

Eternal Attorneys are experts in data protection, privacy information, and cyber security. Kindly contact us for assistance and advice on ensuring compliance with data protection laws and regulations. Eternal Attorneys can be reached through Mobile No: +255 749 668 866 or email info@eternal.co.tz.