Applicability

The Act applies to any person engaged in the collection or processing of personal information or data, any public institution engaging in the collection and processing of personal information or data and to data subjects.

Type of data protected

Information identifying a person which have been stored in any inform, which includes information concerning the colour, origin, tribe, religion, age, marital status, education, medical history, crime, employment, identification number, address, finger print, blood group, or any other data considered to be personal by a data collector.

Guiding Principles

The Act requires data collectors and processors to ensure that personal data is lawfully collected for a legitimate purpose which has been disclosed to the data subject (the individual who is subject of the personal data), complete and accurate, kept and processed in a manner which ensures security of the data against unauthorised processing of data contrary to law.

Data Transfers

There is no prohibition on data transfer, however it is required that transfer shall be done only to a country which has adequate legal protection to personal data.
The transferred data has to be necessary and important for the public interest or for any other legitimate reason.

Restrictions

The Act prohibits processing of sensitive personal data without a written consent of the data subject. Such as information concerning genetics, children, offences, person’s ethnic origin, political ideology, health, financials, security, or any other information which pursuant to written laws is considered to have a significant impact on justice and interest of the individual to whom the information belongs.

Sanctions

The Commission established under the Act will have authority to ensure implementation and enforcement of the Act. The maximum penalty issued by the Commission in the enforcement notice is TZS 1,000,000.
The violation of the Act is also a criminal offence which on conviction carries a fine and or imprisonment.