Transferring personal data outside Tanzania is regulated, and in practice every such transfer needs approval from the Personal Data Protection Commission (PDPC) first. This guide explains the legal framework, the four steps to follow, and how to improve your chances of getting approval.

At a glance •         All cross-border transfers of personal data from Tanzania require prior PDPC approval. •         The applicable rules depend on whether the destination country has an adequate data protection framework (section 31) or not (section 32). •         Applications are made using Form No. 7 under Regulation 20. •         Data subject consent is not always required.

The Legal Framework for International Data Transfers in Tanzania

 

Cross-border transfers of personal data are governed by:

• the Personal Data Protection Act, Chapter 44, Revised Edition 2023 (PDPA); and
• the Personal Data Protection (Personal Data Collection and Processing) Regulations, Government Notice No. 449C of 2023.

The PDPA distinguishes between transfers to countries with an adequate legal framework and transfers to countries without one. In practice, however, all cross-border transfers require prior approval from the PDPC before any data leaves Tanzania.

How to Transfer Personal Data Outside Tanzania: 4 Steps

Step 1: Determine the Destination Country

Start by assessing whether the recipient country has an adequate legal framework for protecting personal data.

• Adequate legal framework: the transfer is governed primarily by section 31 of the PDPA.
• No adequate legal framework: the transfer is governed by section 32 of the PDPA, provided the data controller shows that appropriate safeguards are in place.

Step 2: Identify the Legal Basis for the Transfer

The data controller must identify the legal basis justifying the transfer.

Transfers under section 31: the controller should show that the transfer is necessary for lawful functions or otherwise meets the statutory requirements.

Transfers under section 32: the controller must establish that appropriate safeguards protect the rights and freedoms of data subjects. These may include:

• contractual protections;
• technical and organisational security measures; or
• other mechanisms capable of ensuring an adequate level of protection.

Independent grounds under section 32(4): a transfer may be permitted even where the recipient country lacks adequate protection, based on grounds such as:

• the data subject's consent;
• contractual necessity;
• compliance with a legal obligation;
• protection of vital interests;
• public interest; or
• legal proceedings.

Step 3: Apply for PDPC Approval Using Form No. 7

Before any personal data leaves Tanzania, the data controller or processor must apply to the PDPC using Form No. 7, prescribed under Regulation 20 of the Regulations.

Your application should clearly set out:

1. the purpose of the transfer;
2. the categories of personal data involved;
3. the recipient and the destination country;
4. the legal basis for the transfer;
5. the safeguards in place to protect the data; and
6. any supporting documents requested by the PDPC.

Step 4: PDPC Assessment and Decision

The PDPC reviews each application on its own merits, considering:

• the nature and sensitivity of the personal data;
• the purpose and scope of the transfer;
• the legal basis relied upon;
• the adequacy of the recipient country's legal framework (where applicable); and
• the technical, organisational and contractual safeguards implemented by the applicant.

The Commission may also carry out its own independent verification before granting approval.

Key Practical Points for Data Controllers and Processors

• Approval is required for every transfer. Prior PDPC approval applies to every cross-border transfer of personal data from Tanzania.
• Requirements vary case by case. The PDPC assesses each application according to its specific facts and circumstances.
• Consent is not always required. Where another lawful ground under section 32(4) applies, approval may be granted without the data subject's consent.
• Section 32(5) is not the only route. It should not be read as the exclusive legal basis for international transfers. It gives flexibility for transfers to jurisdictions without adequate data protection laws, provided the PDPC is satisfied that appropriate safeguards exist.
• The PDPC decides adequacy. The Commission determines whether a recipient jurisdiction offers adequate protection and whether the proposed safeguards comply with the PDPA.

Frequently Asked Questions

Do I need PDPC approval to transfer personal data outside Tanzania?

Yes. In current practice, prior PDPC approval is required for all cross-border transfers of personal data, whether or not the destination country has an adequate legal framework.

Which form is used to apply for a cross-border data transfer in Tanzania?

Applications are made using Form No. 7, prescribed under Regulation 20 of the Personal Data Protection Regulations.

Is data subject consent required for an international data transfer?

Not always. Consent is one of several grounds under section 32(4). Others include contractual necessity, legal obligations, vital interests, public interest and legal proceedings.

Who decides whether a foreign country has adequate data protection laws?

The PDPC is responsible for determining whether a recipient jurisdiction provides an adequate level of protection.