Data Controller or Data Processor: Which One You Register As

This page is the data-role operating file: how a Tanzanian business works out which of the Act’s three registered roles it occupies, activity by activity, and what each obliges it to lodge. It is not a privacy-policy template, nor a summary of the European regulation most online guidance quietly reproduces.

• Where registration sits in the first three months: Tanzania 90-day launch plan
• The records behind the data: bookkeeping that supports returns
• Premises that hold the servers: fire safety certificates
• Diligence discipline on a site file: investment land checklist

As at 14 September 2026. Confirm the live registration categories, forms and fees with the Personal Data Protection Commission on pdpc.go.tz; this file rests on the Personal Data Protection Act, No. 11 of 2022 and the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, GN No. 449C of 2023.

The Act names three roles, not two

Act No. 11 of 2022 is administered by the Personal Data Protection Commission, and it covers both sides of the Union under one text. There is no second commission for the islands: a Zanzibar company registers with the same body as a Dar es Salaam one.

The statute does not present a binary. It defines a data collector, a data controller and a data processor, and GN No. 449C carries registration machinery for each. A company framing this as controller-or-processor has already dropped one of the three answers the portal may want.

In working form: the collector gathers the personal data; the controller decides, alone or jointly, the purpose of the processing and the means by which it is done; the processor handles the data on the controller’s behalf and to instruction. A single company can occupy all three positions in one week, on three different sets of data.

The test is who fixes purpose and means

The role is not selected. Put two questions to every processing operation: why is this data handled, and how: on which system, how long, disclosed to whom. Whoever answers them is the controller, whatever the services agreement calls that party.

A label does not move the mandate. An agreement describing a supplier as a processor, while that supplier sets its own retention, mines the records for its own product, or appoints sub-processors unasked, has described a second controller. The Commission reads the arrangement rather than the heading.

The unit of analysis is the processing operation, not the company. A Dar es Salaam accounting practice controls its own payroll and prospect list, and processes the client ledgers it maintains to written instruction. Both answers hold at once, and registration must reflect that rather than the cheaper role.

How the roles fall in arrangements this desk sees

Sensitive data and data leaving Tanzania come first

Two restrictions bind before the role question matters. Sensitive personal data (health, biometric and genetic records, sexual life, religious or political belief, criminal convictions, and anything concerning a child) sits under a tighter permission set than ordinary personal data. Holding it as processor rather than controller does not loosen that set; it changes only who answers first.

The second restriction is territorial. Personal data does not leave the United Republic on the strength of a cloud subscription. The Act conditions transfer abroad on the protection available at the receiving end, and the controller here, not the foreign platform, carries that point. Accepting a vendor’s standard terms does not establish a transfer basis. Settle it before go-live; unwinding a hosted dataset costs far more than choosing the region at the start.

Where the data service is the business (a scanning bureau, a verification or credit-reference house) read GN No. 487A of 2025 before the shareholding is fixed. Reserved and restricted activities screen on who genuinely owns the company.

Registering in the right category

1. Inventory the processing, not the departments: each operation separately, with its purpose, the people it touches, where it is stored and for how long.
2. Answer purpose and means line by line: one sentence per operation naming who decides; that sheet answers every later question.
3. Flag the sensitive and cross-border lines first: those two columns drive the permissions and the hosting decision.
4. Register in every category you occupy, through the Commission’s portal, before processing starts rather than after a complaint.
5. Paper each processor relationship: instruction, scope, security, sub-processors, and return or destruction at the end.
6. Name an internal contact and a breach route: one person who receives incident reports and knows the notification window.
7. Refile on change: new processing, a new hosting country or altered particulars opens its own filing question.

Documents the registration file needs

Certificate of incorporation with a current BRELA extract, or the BPRA equivalent for a Zanzibar company; the taxpayer identification number; the business licence for the activity carried on; a board resolution authorising registration and naming the contact person, with that person’s identity document; the processing inventory, showing purpose, lawful basis, categories of data subject and retention period; a retention schedule reconciled against the five-year minimum in the Tax Administration Act, Cap. 438 and the longer periods employment and anti-money-laundering files attract; a description of security measures; and the signed processing agreements, naming the country each supplier sits in.

Assemble the inventory before opening the portal account. Categories, forms and the fee sit in the Schedule to those Regulations, and the Commission publishes the current version. No fee figure appears here; Zatra’s own fee appears only on the pricing page.

The written instruction that makes someone a processor

A processor is defined by acting on instruction, so the instruction must exist on paper. The clauses that matter: subject matter and duration; the categories of data and of data subjects; a statement that the supplier acts only on documented instructions and takes no purpose of its own; confidentiality binding its staff; agreed security measures; whether sub-processors are permitted, and on what notice; help with data-subject requests and breach reporting; and termination: data returned in a usable format, or destroyed with a certificate.

Two commercial points belong in the same document. An audit right, because a controller that cannot inspect can demonstrate nothing. And hosting location as a written term: a platform that quietly moves storage to another region has changed your transfer position for you.

Worked example: one broker, two outsourcings

An insurance broker in Dar es Salaam outsources twice: claims files scanned by a Tanzanian bureau on its written instruction, and staff records held on a foreign human-resources platform. Illustrative arithmetic, not a quotation.

The bureau bills TZS 7,000,000 a month, TZS 84,000,000 for the year. VAT at the 18% standard rate under the Value Added Tax Act, Cap. 148 adds TZS 15,120,000. Withholding on a service payment to a resident at 5% under the Income Tax Act, Cap. 332 moves TZS 4,200,000 from the remittances into the broker’s monthly returns. The broker controls; the bureau processes, and registers in its own right.

The platform bills the equivalent of TZS 8,000,000 a month, TZS 96,000,000 annually. Withholding to a non-resident at 15% under Cap. 332 is TZS 14,400,000, and imported services carry VAT at 18%, TZS 17,280,000, accounted for by the broker. The role has not changed, the broker still controls, but this processor sits abroad, making it a transfer question before it is a contract question.

Fees across the two lines reach TZS 180,000,000 before tax; only one needed a transfer basis. Confirm the live schedule on tra.go.tz; Finance Acts move these rows.

Where this file stalls

• A privacy notice copied from a European site, promising rights the Tanzanian Act does not use.
• A single category lodged where the business plainly collects, controls and processes.
• An inventory built by the IT department alone, so payroll, security-gate visitor books and CCTV never appear on it.
• A supplier agreement with a data-protection heading but no instruction, security schedule or exit clause.
• An incident found by an employee with nobody to report it to, so the notification window expires inside the company.

What has moved since the Act commenced

The statute was passed in 2022 and the operating detail followed in 2023, with the collection-and-processing and complaints-settlement regulations made under it. The Commission became a working desk rather than a provision on paper, with a portal and published guidance.

The registration window has been extended more than once since those Regulations took effect. Any deadline quoted to you in an earlier year should be read as overtaken; take the current position from the Commission itself, not a professional circular. Attention has also shifted from registering entities to testing the substance of their processing, so an inventory thin enough to pass as an attachment may fail as an answer to a complaint.

Mandate-holders this page does not replace

The Commission owns registration, guidance and complaints for both sides of the Union. TCRA owns subscriber and biometric data under Cap. 306. The Financial Intelligence Unit and the Bank of Tanzania own what reporting institutions hold under Cap. 423. TRA owns retention of records supporting returns, under Cap. 438. BRELA and BPRA own company particulars, including beneficial ownership under the Companies Act, Cap. 212. Unauthorised access to a computer system belongs to the police and the courts under the Cybercrimes Act, No. 14 of 2015.

An advocate settles the processing agreement and any dispute before the Commission; an auditor tests controls. Zatra Consultants prepares, structures and coordinates the registration file and the inventory behind it, but does not practise law, audit or issue approvals.

What to confirm before you act

• The registration categories the portal offers, and which your inventory obliges you to take.
• The prescribed forms and live fee, read from the Commission rather than a secondary source.
• Whether any processing line touches sensitive personal data or a child’s data, and what that changes.
• Where each system physically stores the data today, and what your contract says if the supplier relocates it.
• Whether your retention schedule reconciles with Cap. 438, Cap. 366 and Cap. 423 without contradicting your published notice.
• Whether each supplier you call a processor is in fact taking instructions from you.