Data collectors, processors given six months to register with commission

DAR ES SALAAM: IN a significant move to fortify data privacy measures, the Personal Data Protection Commission (PDPC) has initiated a mandatory registration system for data collectors and processors.

The commission, in accordance with section 14 (1) of the Personal Data Protection Act No.11 of 2022, has mandated a six-month window for entities to complete their registration.

President Samia Suluhu Hassan officially inaugurated the registration system in Dar es Salaam on Wednesday last week, signalling the government’s commitment to upholding data privacy rights.

Advertisement

This initiative comes as a response to the increasing digitalisation of services and the growing concerns surrounding the misuse of personal information.

According to a public notice released by the PDPC, entities falling under the definition of data collectors and controllers are required to register through the commission’s online platform.

The registration process aims to identify and regulate individuals, organisations, or public bodies responsible for determining the purpose and means of processing personal data. In simpler terms, a data controller is any entity, whether a natural person, legal entity, or public body, that exercises control over the processing of personal data.

This includes scenarios such as a healthcare facility where a doctor collects patient information, making them the data controller responsible for the processing of that data.

Similarly, businesses utilising digital platforms like social media or Google Workspace for internal operations are also considered data controllers.

In such cases, the business entity is accountable for ensuring compliance with data protection regulations, while the digital platform acts as the data processor, facilitating the processing of personal data as per the controller’s instructions. Conversely, a data processor is an entity tasked with processing personal data on behalf of the controller, operating under the controller’s instructions.

This could include activities such as commercial or non-commercial operations, educational research, or implementing various IT processes. An illustrative example of a data processor would be a software company providing marketing and advertising software to clients.

Should these clients input personal data collected from their own customers, the software company would then assume the role of a data processor, handling the data as per the controller’s directives.

The registration mandate by the PDPC underscores the importance of accountability and transparency in data handling practices.

By requiring entities to register, the commission aims to enhance data protection measures, mitigate risks associated with data breaches, and ultimately foster trust in the digital ecosystem.

Entities subject to this registration requirement are urged to promptly adhere to the deadline set by the PDPC to ensure compliance with the regulatory framework and uphold the fundamental rights of data subjects in Tanzania.

Roles and responsibilities of data controllers and data processors include overseeing how data is used, controlling and supervising the duties of the data processor, and ensuring that data is used, stored and processed by the guidelines of the Commission.

They also oversee the process from obtaining data consent to enabling data usage for the required process. Minister for Information, Communication, and Information Technology, Nape Nnauye, said the newly launched system encompasses various functions, including the registration of data controller, processors and protection officers, the issuance of registration certificates, and the handling of complaints related to breaches of data protection principles.

Additionally, it facilitates payments through the government’s electronic gateway and enables the commission to disseminate quarterly reports on the state of personal data protection trends.

“The system also has notifications, permit, ratification and report modules, data subjects or complains module,” he said.