The Parliament of Tanzania announced, on 1 November 2022, that it had passed the Personal Information Protection Bill, following its submission to the Parliament on 8 September 2022. In particular, the bill proposes the enactment of the Personal Information Protection Act 2022, which will come into force on a date the Ministry of Information, Communication, and Information Technology will appoint in the Government Gazette. Moreover, the bill aims to set the minimum level of collection and processing of personal information and to establish a commission for the protection of personal data.

Furthermore, the bill establishes a requirement to register as a data controller or data processor in order to process personal data, which shall be submitted to the commission. In addition, the bill sets out provisions regarding the procedure for the collection, use, and storage of personal data, particularly specifying the circumstances under which personal information may be disclosed. Accordingly, the bill highlights, among other provisions, that data controllers may use or disclose personal information if the data subject has authorised the use or disclosure of their information to another person. More specifically, the bill establishes the conditions of international transfer of personal information, including the concept of adequacy being used as a criterium to transfer personal information.

Additionally, the bill notes that the commission may issue an enforcement notice if it is satisfied that a person has failed to comply with the Act and provides that the maximum penalty that can be issued by the commission in a penalty notice in relation to a violation of the Act is TZS 100 million (approx. €41,320).

You can read the bill here and access the legislative portal here, both only available in Swahili.