Tanzania

Section 5 requires personal data to be processed lawfully, fairly and transparently. Section 23 requires collection from the data subject with notice of purposes and recipients, and section 30(1) requires prior written consent for sensitive data. Sections 33 to 38 give rights of access, objection, rectification and erasure, and compensation.

Section 27(5) requires the controller to notify the Commission of a security breach affecting personal data it processes or that is processed for it. The section sets no fixed number of hours or days.

Section 14(1) prohibits collecting or processing personal data without registration. Section 16(1) sets a five-year registration term, and section 16(2) requires renewal applications within three months before expiry.

Section 4 provides for disclosure to a Competent Authority or a locally trusted person, and section 5 allows written, oral or sign-language disclosure. Section 10 requires protective action, and section 16(1) makes disclosing a whistleblower's identity an offence.

Section 15(2) requires a written contract in the stated cases and section 16(1) requires a written statement of particulars when employment starts. Section 16(5) requires the particulars to be kept for five years after termination.

Section 19(1) requires a reporting person to designate a natural person as money laundering reporting officer, screen staff, run regular training, keep a compliance function and arrange independent audits. Section 20 extends group-wide programmes to foreign branches and majority-owned subsidiaries.

Section 17(1)(b) requires records to be kept for at least ten years from completion of the transaction, the formal end of the relationship, or completion of the related analysis or risk assessment. Section 17(2) requires longer retention where a report was made to the FIU or an investigation is known.

Section 16(1)(a) requires CDD in line with the identified risks, before establishing a business relationship and before an occasional transaction. Section 16(1)(d) bars starting the relationship before CDD is complete, except where risk is proven low.

Guideline 8 requires prior written approval before adopting cloud for a non-mission-critical system. Guideline 7(a) prohibits hosting mission-critical systems outside Tanzania, and guideline 10 requires a Bank-approved written contract. The guidelines set no incident reporting deadline.

Section 7 requires the Bank's prior written approval for material outsourcing or any variation to it. Section 15 requires a Bank-approved written contract and section 14 requires the outsourcing policy to be cleared before use. Section 10(g) prohibits outsourcing a primary data centre outside Tanzania.

Section 18(1) requires a report within twenty-four hours after forming the suspicion and, where possible, before the transaction proceeds. Failure to report is an offence under section 18(4).

Regulations 12 and 13 require a non-bank issuer to form a separate legal entity and apply for an e-money licence. Regulation 26(2)(a) requires a trust account in a bank, and regulation 24(5) requires e-money in circulation to equal the funds held in the trust or special account.

Regulation 7 provides for written notice of admission within 45 days, and regulation 7(3) states that approval allows testing only and is not authorisation to offer the solution to the public. Regulation 10(1) requires testing to be completed within 12 months of approval.

Section 5 requires a Bank licence to operate a payment system. Under section 7(4) the Bank decides within 30 days and under section 7(6) a licence is valid for five years unless suspended or revoked. Section 24 requires a licence or approval to issue electronic money.

Section 39(4)(c) requires a service provider that knows of illegal information or activity to notify the appropriate law enforcement authority, and sections 39(4)(a) and (b) require removal of the information and suspension of related services. Section 39(1) states there is no general duty to monitor.