Employee Data and HR Files: What the Data Protection Act Reaches

This page is the employee data operating file: which parts of an HR record the Act reaches, on what basis an employer may hold them, for how long, and where they may be sent. It is not a privacy-policy template and not a labour-law manual.

• Dismissal papers: the file the CMA reconstructs
• Non-citizen staff: ratios and sector overlays
• Passport and permit data: residence permits
• Medical and safety records: OSHA registration

As at 14 September 2026. Confirm the live register, forms and fee bands with the Personal Data Protection Commission. This file also rests on the Employment and Labour Relations Act Cap. 366 and the Occupational Health and Safety Act Cap. 297.

The regulator of the personnel folder

The Commission holds the mandate. It registers data controllers and data processors, issues the certificate, receives breach reports and hears the data subject’s complaint. An employer becomes a controller the day it accepts a job application.

The Act is expressed to extend to Mainland Tanzania and Tanzania Zanzibar, so an island branch is not outside the regulator. What sits underneath does split: employment terms run to Cap. 366 or to Zanzibar’s own Employment Act; contributions go to NSSF or ZSSF; tax is TRA against ZRA. One data regulator, two personnel regimes beneath it.

Holding a record is not a reserved activity. The restriction in an HR file sits on who may hold the job (permit quotas, sector rules), not on who may hold the paper.

What the folder contains that the Act calls personal data

Anything identifying a living individual: staff number, TIN, NSSF membership number, bank account, next of kin, passport copy, CV and referee notes, appraisal scores, warning letters, attendance logs, the roster on a supervisor’s phone.

A second class carries a higher bar: sensitive personal data, covering health, biometric and genetic data, sexual life, racial or ethnic origin, political opinion, religious belief, trade-union membership and criminal records. Three of those arrive uninvited: the periodic medical taken under Cap. 297, the fingerprint template inside the clock-in device, and the disciplinary paper recording an allegation of theft. Most employers hold sensitive data without ever having decided to.

The basis, and why a group memo is not one

A controller must be able to state its basis before the first record, per class of data, not once for the company. The Act carries consent alongside the necessity conditions: performance of the contract, compliance with a legal obligation, vital interests, and the rest of the live section list. Six bases lifted from a European policy are not those conditions, and the Commission reads its own.

Employee consent has a defect the Act does not cure: it is given to the person who signs the payslip, and it can be withdrawn on the morning of a disciplinary hearing. Rest payroll, statutory returns and safety records on the obligation that actually exists: PAYE under the Income Tax Act Cap. 332, contributions under the National Social Security Fund Act Cap. 50, personnel particulars under Cap. 366, medical surveillance under Cap. 297. Keep consent for the optional: the website portrait, the wellness scheme.

Cameras at the gate, biometrics at the clock, trackers in the fleet

Three systems bought by operations, rarely routed past HR, each producing data about named staff.

Footage of an identifiable person is personal data, so notice belongs at the point of collection rather than in a handbook clause nobody signed. The cameras that turn a stock-loss investigation into a complaint are those in changing rooms, ablution blocks and clinic corridors.

A fingerprint or face template is sensitive, and it usually lives on a vendor’s server. Four questions before the reader is bolted to the wall: where the template sits, whether it leaves the country, what deletes it on the leaver’s last day, and what alternative exists for the worker who declines.

Vehicle trackers produce a minute-by-minute record tied to a named driver. Between shifts it stops describing your cargo.

The employee data register, class by class

The payroll leaves the building every month

Payroll is the largest routine disclosure an employer makes, and it reaches four bodies before the salary reaches an account. Take a Dar es Salaam manufacturer with 240 people at an average gross of TZS 1,200,000 a month: emoluments of TZS 288,000,000. Skills and Development Levy at 3.5% under the Vocational Education and Training Act Cap. 82, which bites on employers of ten or more, is TZS 10,080,000. NSSF at 20% of gross under Cap. 50, ten points from the employer and ten withheld from the worker, is TZS 57,600,000. The Workers Compensation Fund contribution at the private-sector rate of 0.5% under the Workers Compensation Act Cap. 263 is TZS 1,440,000. PAYE is deducted per head and remitted by the seventh day of the following month under Cap. 332. Illustrative arithmetic, not a quotation.

Each filing carries individuals by name, number and amount: 240 records, twelve times a year, is 2,880 name-level disclosures before the bank file and the medical scheme are counted. Name all four recipients in the register. If payroll is prepared outside the country, every one of those rows crosses a border before reaching TRA.

The bureau in another capital, the server in another continent

The Act restricts moving personal data out of Tanzania, and the conditions turn on the protection available at the destination and on what the Commission requires of the exporter. Most employers export without deciding to: an HR system hosted abroad, a regional payroll bureau, a group HRIS the parent bought, a spreadsheet emailed to a regional finance director.

Each is a transfer. Record the destination country and the hosting company, take the processor’s written undertaking on security, deletion and sub-processing, and settle whether your stated basis covers the export as well as the collection. Ask what the live Regulations want filed before the first upload, not after an auditor opens the question.

The sequence the desks actually take

1. Inventory before policy. One line per class of data, per system, per location, with an owner named.
2. Fix the basis per class against the Act’s own conditions, and note why consent was or was not used.
3. Register with the Commission. Prescribed application, incorporation or identity documents, and the fee, which is set by how many people the applicant employs. Short statutory turnarounds apply: seven days to consider the application, fourteen to give reasons where it declines.
4. Post notices where collection happens: the gate, the clock, the application form, the payslip portal.
5. Paper the processors. Written instructions to the payroll bureau, the HRIS vendor, the monitoring firm and the recruitment agency, before more data is handed over.
6. Clear the cross-border leg for every system storing outside Tanzania.
7. Set retention per class against the Cap. 366 floor, with a named officer on destruction.
8. Rehearse the breach route once, on paper, so the first attempt is not the morning of a ransomware note.

Documents this file needs

The Commission’s application form and, once issued, the certificate with its renewal diarised. It runs five years from issue and is renewed in the three months before expiry. Certificate of incorporation, BRELA extract and TIN. The headcount that fixes the fee band. The inventory itself. Separate notices for employees and for applicants, in a language the workforce reads. Written processor terms with each vendor. Camera signage and a siting note. A recorded basis for biometric enrolment. A retention schedule by class, signed. A breach log. And the particulars Cap. 366 requires: contract, wage record, hours, leave, discipline.

Retention: a floor in Cap. 366, a ceiling in the Act

Cap. 366 requires an employer to keep written particulars for each worker and hold that record five years after the employment ends. The Act says data may not be kept longer than its purpose needs. The two do not collide: the statute supplies the purpose, and five years is the floor for the classes it names.

What has no floor is the larger half of the folder: the CV of a candidate never hired, the template of a leaver, footage from an uneventful Tuesday, the sick note copied across when the original belongs in the occupational health record. Draw that line per class, in writing.

When a leaver asks for their file, the Act gives access and correction rights with a complaint route behind them. Answer in writing inside the period the Regulations set. Treating that request as a bargaining move in a severance talk is how it becomes a second dispute.

Where this file stalls

• A policy PDF exists; no inventory does, and nobody knows which server holds the templates.
• Registration never completed, or left to lapse at the five-year mark with nobody diarised.
• One tick box in the contract used for payroll, cameras, biometrics and publicity at once.
• An offshore bureau engaged on a quotation alone, with no processor terms and no transfer analysis.
• Personnel files cleared at exit, then demanded by the CMA under the Labour Institutions Act Cap. 300.
• A breach closed by the IT contractor as a support ticket, with no log and no route to the regulator.

Mandate-holders this page does not replace

The Commission owns registration, complaints and breach. TRA owns PAYE and the Skills and Development Levy and receives named payroll data monthly; ZRA is the island counterpart for non-Union taxes. NSSF, ZSSF and the Workers Compensation Fund own contribution records. The Labour Commissioner owns the non-citizen work permit while Immigration owns the residence permit. OSHA owns workplace registration and the medical surveillance that generates the health file. The CMA reconstructs the dismissal record. Where the question hardens into a dispute, an advocate owns it.

Zatra prepares, structures and coordinates the pack. It does not practise law, audit, or issue the Commission’s certificate, and no approval is guaranteed.

What to confirm before you act

• The live application form, fee band and registration deadline: that deadline has moved more than once since the Regulations came into force.
• The Government Notice number and current text of those Regulations against the Gazette before either is cited in a contract.
• Whether your class of controller must appoint a named officer for data protection.
• The conditions for sending staff data out of the country, and whether anything must be filed first.
• Current PAYE, SDL, NSSF and WCF schedules on tra.go.tz and the fund portals before relying on the arithmetic above; Finance Acts move these rows.
• Which employment instrument and which social-security fund a Zanzibar branch answers to.