PDPC warns unregistered data handlers of sanctions

DODOMA: INSTITUTIONS collecting or processing personal data without registration have been warned to comply with the law or face penalties as the Personal Data Protection Commission (PDPC) begins enforcement.

Under the Personal Data Protection Act, the requirement applies to data collectors and processors, including institutions in sectors such as health, education, finance, telecommunications and other organisations that handle personal information such as names, identification numbers, contact details, health records and financial data.

Speaking to journalists in Dodoma yesterday, PDPC Director General Dr Emmanuel Mkilia said the period for voluntary registration ended on April 8 this year and the Commission has now begun taking action against entities operating outside the law.

“Todate more than 14,000 institutions had successfully registered with the Commission, reflecting growing awareness of the need to protect citizens’ privacy and personal information,” he explained.

However, he said that some institutions, particularly in sensitive sectors such as health and education, are still collecting and processing personal data without complying with legal requirements.

“This is a direct violation of the law and poses a serious threat to the fundamental privacy rights of citizens,” he cautioned. Dr Mkilia reminded data collectors and processors that under the Personal Data Protection Act, it is illegal to collect or process personal information without first registering with the Commission. “

Any institution found collecting or processing personal data without registration commits an offence and will be subject to legal action, including fines and administrative sanctions as provided for under the law,” he warned.

The Commission has directed institutions that initiated registration but failed to complete the process to do so within seven working days from June 12 and those that have not started the process have also been given the same deadline.

Dr Mkilia said compliance inspections have already commenced across the country, with institutions required to demonstrate adherence to data protection requirements.

“All institutions must ensure that they have approved personal data protection policies and robust systems to safeguard information against unauthorised access, misuse or disclosure,” he said.

He also urged people to exercise their rights by reporting cases involving unlawful use of personal information or violations of privacy.

“The Commission remains committed to providing public education, guidance and oversight to ensure Tanzania develops a strong personal data protection framework that safeguards citizens’ rights while promoting confidence in digital services and emerging technologies,” he said.

The warning came in ahead of first Privacy and Personal Data Protection Conference from June 29 to July 1 at Mlimani City Conference Centre in Dar es Salaam prepared by the Commission.

The conference is expected to bring together data protection officers, privacy professionals, regulators and international experts to discuss emerging technologies, share experiences and strengthen cooperation in promoting secure and inclusive digital services.