Consent, Retention and Transfer: Three Tests, Not One Policy

This page is the personal data operating file: it decides the lawful ground for each purpose, how long the record must survive, and what permits it to cross the border. It is not a privacy-policy template and not a substitute for the Commission’s registration desk.

• Records behind the returns: bookkeeping for filings
• First ninety days: launch compliance plan
• Cap-table changes: share transfers and restructuring
• Premises file: fire safety certificates

As at 14 September 2026. This file rests on the 2022 Act and its 2023 Regulations; confirm current registration categories, forms and reporting windows with the Personal Data Protection Commission.

Three tests, and which desk answers each

The Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023: GN No. 449C of 2023: put the register, the prescribed forms and the procedure under the statute. The Act reaches Mainland Tanzania and Tanzania Zanzibar: a Stone Town hotel and a Kariakoo lender answer to one Commission.

The overlay differs. Mainland tax documents sit with TRA, Zanzibar non-Union records with ZRA, statutory registers with BRELA or BPRA. The data duty is common; the keeping duty on the same file is not.

Lawfulness asks which ground you stand on. Retention asks how long another instrument obliges you to hold the record. Transfer asks what permits it to leave the country. A notice answering only the first, published as proof of compliance, leaves two files open.

Registration comes before the policy

The Commission keeps a register of data collectors and data processors. A company deciding what is collected and why is a collector. One handling that data on another’s instructions is a processor. A payroll bureau or hosted HR platform is usually both, and registers in both characters. Applications run on the forms and fee schedule in the 2023 Regulations, and the certificate is renewed on the term they prescribe. Confirm the live categories, fees and term at the Commission; Zatra’s own fee sits on pricing.

Screen the underlying activity first. A certificate from the Commission is not a business licence and does not open a class of trade reserved to citizens under GN No. 487A of 2025. A foreign-owned processor still needs registry standing, a TIN, a business licence and, in a licensed sector, the sector approval: whose conditions on outsourcing and hosting sit above the Commission’s, not instead of them.

Consent is a record, and often the wrong ground

Consent must be freely given, specific, informed and unambiguous, and whoever relies on it must show that it was. That last requirement is the operational one: a box already ticked, agreement bundled into terms of service, a one-word reply on WhatsApp, none produce evidence carrying a timestamp, a purpose list, and the version of the notice the person saw.

Build the log so it can be printed and handed over: who agreed, when, to which purposes, under which numbered notice, and when they withdrew. Withdrawal must be no harder than agreement. For a child, the Act looks to the parent or guardian. For sensitive categories (health, biometric and genetic data, criminal records, political or religious affiliation) the threshold rises and the purpose narrows.

Consent is also frequently the wrong basis. Payroll rests on the employment contract and on statutory duty. Customer identification at a bank rests on Cap. 423, and the customer cannot switch it off. Naming consent where the real basis is legal obligation creates a promise nobody can honour. Choose the ground per purpose: one customer record routinely carries three at once: contract for the service, statutory duty for the identification pack, consent for the marketing list. Only the third disappears on request.

Retention clocks are set outside the Act

The statute says not to hold personal data longer than the purpose demands, without saying how long that is. Other instruments do, and the governing row is the longest applicable one: rarely the one written into the privacy notice.

Write the schedule by data category, not by system. Storage is cheap, which is why marketing databases outlive their purpose by years. A category with no statutory anchor and no live consent is a liability on a disk.

A server abroad is a transfer, and the transfer needs a ground

Choosing a cloud region is a regulated decision, usually taken by an engineer at signup. The Act permits personal data to leave the country where the destination affords adequate protection, or on another permitted ground: informed agreement, performance of a contract with the subject, a legal claim, a vital interest. The Commission rules on adequacy and clears what needs clearing. A checkbox in a foreign vendor’s console is not that decision.

Sub-processors are where these files break. The supplier contracted in Nairobi replicates to Frankfurt, runs support from Bengaluru and pushes logs to analytics in Virginia. Each hop is a transfer. The agreement must name them, bar onward movement without notice, fix incident timelines, permit audit, and oblige deletion at exit. Where a supervisor adds its own hosting or approval condition: the Bank of Tanzania for banks and payment-system providers, TCRA for licensees under the Electronic and Postal Communications Act Cap. 306, TIRA for insurers: both must be met.

An incident abroad is still reported here. GN No. 449C sets the route and the period; establish both before an incident rather than during one, and record the hour of discovery: that is when the clock starts. Where unauthorised system access is involved, the Cybercrimes Act, 2015 opens a second file.

The tax tail on a cross-border processing contract

The transfer analysis has a tax twin that boards meet after signature. Paying a non-resident for hosting, analytics or support is an imported service. Value Added Tax on imported services is self-accounted at the standard rate of 18% under the Value Added Tax Act Cap. 148. Service fees and royalties paid to a non-resident carry withholding at 15% under the Income Tax Act Cap. 332, subject to relief under a double taxation agreement where one exists and is properly claimed.

Illustrative arithmetic, not a quotation. A Dar es Salaam insurer contracts a European processor at USD 48,000 a year. Converted at an illustrative TZS 2,600 to the dollar, the annual fee is TZS 124,800,000. Tax on the imported service at 18% is TZS 22,464,000, self-accounted on the return. Withholding at 15% is TZS 18,720,000, deducted and remitted, leaving TZS 106,080,000 to the provider, unless the contract carries a gross-up clause, in which case the Tanzanian cost rises by about a fifth.

Read that row before the signature page. Whether the payment is a service fee, a royalty or software licensing changes the treatment, and the call belongs to the tax file rather than the vendor’s order form.

The sequence a file actually takes

1. Map the data: categories, purposes, systems, and everyone touching each, before policy is drafted.
2. Assign a ground to every purpose: contract, statutory duty, vital interest, public function, consent, and minute the reasoning.
3. Register with the Commission as collector, processor or both, on the current prescribed forms, and diarise renewal.
4. Set the keeping schedule against Cap. 438, Cap. 366, Cap. 423 and Cap. 212, then against purpose.
5. Fix the transfer position: list destinations and sub-processors, and take the Commission’s view where it is needed.
6. Paper the contracts: processing terms, onward-transfer limits, breach timelines, audit rights, deletion at exit.
7. Publish the notice last, versioned and dated, so it describes the company that exists.
8. Rehearse the incident: one named owner, one register, one route, tested in advance.

Documents the file needs

• The registration application lodged with the Commission, and the certificate issued on it
• A record of processing activities: category, purpose, ground, source, recipients, destinations, retention
• Consent logs exportable per person, showing purposes, channel, date and any withdrawal
• A processing agreement with each supplier, and the current sub-processor list
• The keeping schedule approved in a board minute, an incident register, and vendor deletion certificates

Where this file stalls

• A policy copied from a European site, naming a supervisory authority Tanzania does not have
• Consent cited as the basis for payroll, until an employee withdraws it and nobody has an answer
• Applicant CVs from four recruitment rounds, kept because deleting them is unpaid work
• A supplier agreement with no sub-processor list and nothing said about data at termination
• Registration treated as the closing step, months after the notice went live

What changed since the Act commenced

The 2023 Regulations turned the statute into a working procedure: registration characters, prescribed forms, fees and complaints handling. Waiting for subsidiary legislation stopped being an answer in 2023. Nothing in the tax rows above was rewritten for data specifically: the imported-service and withholding treatment of a hosting contract is ordinary Cap. 148 and Cap. 332 work. Finance Acts move those rows, so confirm the live schedule on tra.go.tz.

Mandate-holders this file does not replace

The Commission owns registration, the lawful-ground question and the transfer gate. TRA owns tax-document retention and the treatment of the foreign invoice; ZRA owns the island rows. BRELA and BPRA own registers no erasure request can touch. The Financial Intelligence Unit stands behind identification records held for ten years. TCRA owns subscriber data for communications licensees, the Bank of Tanzania the conditions on banks and payment providers, TIRA the insurance side. Where an incident is also an offence, the 2015 cybercrime statute moves matters to police and prosecution.

Zatra prepares, structures and coordinates the pack: data map, schedule, application, supplier terms, board papers. It does not issue certificates, does not practise law, and assures no regulatory outcome.

What to confirm before you act

• The registration character, forms, fees and certificate term the Commission applies
• The incident-notification route and period in force, and who inside the company owns the first hour
• Whether the destination country is accepted as affording adequate protection, or the movement needs clearing
• Whether BOT, TCRA or TIRA adds a hosting, outsourcing or approval condition to the same contract
• The tax treatment of the supplier invoice, with TRA, before a gross-up clause is agreed

Read the supplier contract and the published notice against each other before either is relied on. Most Tanzanian data files fail not because the law is obscure but because those two documents describe different companies. The first ninety days is when that gap is cheapest to close.