As the global exchange of information becomes increasingly prevailing, safeguarding personal data during cross-border transfers is essential. The following are the key terms as defined in the PDP Act which we find relevant to this updater:. The PDP Act sets strict requirements to ensure that personal data is protected during cross-border transfers. Section 31 of the PDP Act authorises the transfer of personal data to countries that have established a legal framework providing adequate personal data protection.
This determination is based on several factors, including the legal environment in the recipient country and the necessity of the data transfer. The recipient must demonstrate that the transfer is necessary for tasks carried out in the public interest or pursuant to the lawful functions of a data controller and that the transfer will not compromise the legitimate interests of the data subject.
Despite the PDP Act authorising transfer of personal data to such countries, the transfer will be subject to obtaining a permit from the Personal Data Protection Commission the Commission as further expounded below. The conditions under which such transfers may be permitted include:. The recipient country must provide an adequate level of protection.
Adequacy is assessed by considering factors such as the nature of the personal data e. Even in cases where the recipient country does not meet adequate protection standards, personal data transfers may still occur under particular circumstances as provided under section 32 4 of the PDP Act.
These include instances where:. The PDP Regulations outline the procedural requirements for obtaining permission to transfer personal data outside Tanzania. In particular, regulation 20 of the PDP Regulations details the application process that data controllers and data processors must follow to secure a permit from the Commission to transfer personal data outside Tanzania.
