Data Protection Officer

• Monitor and ensure compliance with the PDPA, the Personal Data Collection and Processing Regulations, 2023, the Complaints Settlement Procedures Regulations, 2023, PDPC guidelines and directives, BOT consumer protection requirements and related internal policies.
• Prepare and submit the statutory quarterly compliance report to the PDPC within the prescribed timelines, together with any other returns, notifications or information requested by the Commission.
• Serve as the designated liaison and point of contact between the institution and the PDPC, including during inspections, investigations, mediation and complaint proceedings before the Commission.
• Receive, log and resolve data subject requests and complaints (access, rectification, erasure, objection, withdrawal of consent and halting of processing) within statutory timelines, including acknowledging a request to halt collection within 72 hours, and maintain a register of all requests, responses and outcomes.
• Identify and report in writing to management any violation of the PDPA or its Regulations in the institution’s processing of personal data, and advise on rectification and corrective measures.
• Advise management and staff on data protection obligations, including the lawful basis for processing, prior written consent for sensitive personal data (which under the PDPA includes financial data), purpose limitation, data minimisation and accuracy.
• Review and approve new products, systems, projects and vendors involving personal data, and conduct Data Protection Impact Assessments (DPIAs) for high-risk processing such as credit scoring, GPS or telematics tracking of financed assets, biometric and national ID data, and automated decision-making.
• Coordinate with IT and Information Security on personal data breaches: assess each incident, notify the PDPC without undue delay using the Commission’s prescribed breach notification format, inform affected data subjects where appropriate, and maintain a breach register with root cause analysis and remediation.
• Control cross-border transfers of personal data: ensure no personal data is transferred outside Tanzania (including to group companies, cloud providers or offshore vendors) without the required PDPC permit and appropriate safeguards, and maintain a transfer register.
• Maintain the Record of Processing Activities, consent records, retention and disposal schedules, and evidence of secure erasure or anonymisation at the end of the retention period.
• Review and negotiate Data Processing Agreements (DPAs) and data protection clauses with vendors, agents, dealers, collection partners and group entities, and monitor their compliance through periodic assurance reviews.
• Develop and deliver induction and annual training and awareness programmes on privacy and confidentiality for all staff, with targeted training for high-risk functions (sales, collections, call centre, customer service and IT).
• Conduct periodic privacy compliance audits, follow up on corrective actions, and report findings and compliance status to the Chief Risk Officer and to the Board Risk and Compliance Committee at least quarterly.
• Maintain written records of all advice given, assessments conducted and reports submitted to the PDPC as evidence of due diligence, and keep abreast of PDPC guidelines, directives and enforcement decisions, updating the framework accordingly.

Skills Required

• Spreadsheets (e.g. Excel, Google Sheets, etc)
• Word Processing and Desktop Publishing Tools (MS Office, Google Docs, etc)