Personal Data Protection Act s. 36 — rights in relation to automated decision making, with a duty to notify and reconsider
Binds Data controllers and data processors within the scope of s. 22(1): any collection and processing of personal data performed wholly or partly by manual or automated means; processing carried out in the performance of the activities of a controller domiciled in the United Republic or in a territory where its laws apply by virtue of international public law; and processing by a controller or processor not domiciled in the United Republic where the processing is in the United Republic and is not for mere transit of personal data through Tanzania to another country. Section 2 applies the Act to Mainland Tanzania as well as to Tanzania Zanzibar, save that in Zanzibar it does not apply to non-union matters, so a purely Zanzibari matter falls outside it. Registration with the Personal Data Protection Commission under ss. 14 to 16 is a precondition of acting as a controller or processor, and s. 21 deems public institutions that collect and process personal data registered from commencement. The s. 36(2) notify-and-reconsider duty binds any controller that takes a solely-automated decision significantly affecting a data subject, irrespective of size. Impact tier: all entities.. Section 36 of the Personal Data Protection Act, 2022 (Act No. 11 of 2022, Chapter 44) carries Tanzania's operative automated-decision rule, in Part VI (rights of data subjects). Subsection (1) lets a data subject, through the procedures prescribed in the regulations, require the data controller to ensure that any decision taken by or on behalf of the controller which significantly affects the data subject shall not be based solely on processing by automatic means. Subsection (2) operates without prejudice to that request and bites of its own force: where a decision which significantly affects a data subject is based solely on automated processing, the controller shall as soon as practicable notify the data subject that the decision was taken on that basis, and the data subject may require the controller to reconsider the decision. Subsection (3) disapplies the section where the decision is necessary for entering into or performance of a contract between the data subject and a data controller, is authorised by any written law, or is based on the data subject's explicit consent. Section 37 separately entitles a data subject who suffers damage by reason of any contravention of the Act to compensation from the controller or processor.
Commencement was deferred to a ministerial instrument and that instrument is identified on the face of the published Act: the Chapter 44 text as republished in the Special Gazette prints “[1st May, 2023]” together with “[GN. NO. 326 of 2023]” immediately above Part I, so Government Notice No. 326 of 2023 appointed 1 May 2023 as the date on which the Act, including s. 36, came into operation. The Act itself is Act No. 11 of 2022; the text relied on here is the Chapter 44 republication issued as Government Notice No. 395B in Special Supplement No. 21 to the Special Gazette of the United Republic of Tanzania No. 15 Vol. 104 of 13 June 2023, printed by the Government Printer, Dodoma. Section 36(1) is not self-executing — the data subject's requirement runs “through the procedures prescribed in the regulations”, which are the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 — but s. 36(2) is, because it applies “without prejudice to subsection (1)” and imposes the notification duty directly on the controller. The copy of those 2023 Regulations published by the Personal Data Protection Commission is a scanned image with no text layer, so the prescribed procedure could not be read and no claim about its content is made here; the entry rests on the statute. Coverage symmetry against the four African rows already tracked: s. 36 is drawn from the same UK Data Protection Act 1998 s. 12 lineage as gh-dpa-s41 rather than from GDPR art. 22, and the two are the closest pair on the tracker — both pair a request-based right with an automatic notify-and-reconsider duty. The difference is the clock: Ghana fixes hard twenty-one-day periods in both directions, while Tanzania says only “as soon as practicable” for the notification and sets no period at all for the controller's response, so Ghana remains the only African row with hard deadlines. Tanzania's carve-out in s. 36(3) is narrower than Ghana's s. 41(4) because it does not exclude pre-contractual consideration, and unlike ke-dpa-s35 it gives no right to demand a fresh non-automated decision — only reconsideration of the existing one. Text read in the copy of the Act published by the Personal Data Protection Commission, the supervisory authority established by s. 6 of the Act.
Stated maximum penalty — Enforcement is administrative and runs through Part VII. The Commission investigates complaints under ss. 39 to 42, may serve a notice of enforcement under s. 45 and a notice of penalty under s. 46, and s. 46 lists the factors bearing on the amount, including the nature, gravity and duration of the failure, compliance with previous enforcement or penalty notices, adherence to codes of ethics, and financial benefits gained or losses suffered. Section 47 caps the amount: the maximum penalty that may be imposed by the Commission in a penalty notice in relation to a contravention of the provisions of the Act is one hundred million Tanzanian shillings. Section 48 allows the Commission to review its own decision and s. 49 gives a person aggrieved by the administrative action, including directions in an enforcement notice or a penalty imposed, a right of appeal. Section 37 gives the data subject a separate entitlement to compensation from the controller or processor for damage suffered by reason of any contravention of the Act, and s. 50 governs payment of that compensation. The criminal offences in ss. 60 to 62 address unlawful disclosure and unlawful destruction, deletion, concealment or alteration of personal data and do not attach to s. 36.