Key takeaways
- Treat personal data as a system requirement: map it, minimise it, protect it, and delete it on schedule.
- Role-based access, encryption and audit logs are the core technical safeguards.
- Cross-border hosting and vendor contracts need explicit review.
- This article is engineering guidance, not legal advice; confirm obligations with counsel.
Tanzania's Personal Data Protection Act, 2022 sets rules for how organisations collect, use, store and share personal data, and it is supervised by the Personal Data Protection Commission. For banks, hospitals, NGOs and large companies, the Act turns data protection from an IT preference into a management duty. This article translates the principles into engineering controls your software and vendors should provide.
Note: this is engineering guidance, not legal advice. Confirm your specific obligations, registration duties and timelines with your legal counsel and the Commission's published guidance.
Start with a data map
You cannot protect what you have not listed. For every system, record which personal data it holds (names, phone numbers, national IDs, health or financial details), why you hold it, who can see it, where it is stored and how long you keep it. Sensitive categories such as health and financial information deserve extra care.
Principles that shape system design
| Principle | What it means in software |
|---|---|
| Lawful, fair and transparent processing | Clear notices and recorded consent where consent is the basis for processing |
| Purpose limitation | Fields and reports limited to the stated purpose; no silent reuse |
| Data minimisation | Collect only required fields; avoid free-text capture of sensitive details |
| Accuracy | Ways for staff and data subjects to correct records, with history |
| Storage limitation | Retention schedules, archiving and secure deletion jobs |
| Security | Encryption, access control, logging, backups, patching |
| Accountability | Audit logs, documented processes, named owners |
The technical safeguards that matter most
- Role-based access control: staff see only what their job needs, and administrators are limited and monitored.
- Encryption: HTTPS everywhere, encrypted databases and backups, and protected secrets.
- Audit logging: who viewed, changed or exported personal data and when.
- Strong authentication: unique accounts, strong passwords and two-factor authentication for privileged users.
- Environment separation: never copy production personal data into test systems without masking.
- Backups and recovery: encrypted, off-site, and restored in tests at least quarterly.
Data subject requests
Individuals can ask what you hold about them and request corrections or deletion in certain circumstances. Build a documented process: find the person across systems, export their data, and apply changes. Systems with a clear customer or member identifier make this practical; scattered spreadsheets do not.
Vendors, hosting and cross-border transfers
When a vendor hosts or processes your data, they act on your behalf and your contract should say so. Review where data is stored, who can access it, how incidents are reported and what happens when the contract ends. The Act and sector regulators set conditions for transferring personal data outside Tanzania, so confirm where your cloud servers actually run. Our guide to cloud versus on-premise hosting covers this decision.
Breach response
Prepare before an incident: define what counts as a breach, who investigates, how you contain it, whom you notify and within what time. Keep logs long enough to investigate. Run a tabletop exercise once a year.
A practical 90-day plan
- Days 1-30: build the data map, appoint an owner, and review vendor contracts.
- Days 31-60: fix quick wins: access reviews, two-factor authentication, encrypted backups, retention rules.
- Days 61-90: document procedures, train staff, test restores and the breach plan.
Systems we build for banks, NGOs and healthcare providers, such as SACCOS platforms and hospital information systems, include role-based access and audit trails by default so compliance teams start from a stronger position.
Need a security and data-protection review of your systems? Contact our team for an assessment and remediation plan.
Frequently asked questions
Which law governs personal data in Tanzania?
The Personal Data Protection Act, 2022, supervised by the Personal Data Protection Commission. Organisations that collect or process personal data should review their obligations on consent, security, retention and data subject rights with legal counsel.
What technical controls help with compliance?
Encryption in transit and at rest, role-based access control, audit logs, data minimisation, retention schedules, backups, and a documented incident response process.
Does hosting location matter?
It can. Sector regulators and the Act place conditions on transferring personal data abroad, so confirm where your data is stored and processed and what your contracts say.
Talk to a Melian solution architect
Planning a system for a bank, NGO or large organisation? Get a free discovery call, a scoped proposal and a relevant demo.
Book a free consultation →The Melian Software Digest
Practical insights on ERP, banking and NGO systems, cloud and security for decision-makers in Tanzania. One useful email a month. See a sample issue.
