The PDPA defines “personal data” as any information relating to an identified or identifiable person, that is recorded in any form, including:

• identity details (e.g. name, identification number)
• contact details (e.g. address, correspondence)
• demographic data (e.g. race, nationality, ethnic origin, religion, age, marital status)
• personal records (e.g. education, employment, medical, criminal history)
• biometric data (e.g. fingerprints, blood type)

The PDPA defines “sensitive personal data” to include:

• genetic and biometric data
• data related to children or offences
• financial transaction or security related data
• personal data revealing racial, ethnic, political, religious or philosophical attributes
• affiliation or trade union membership data
• gender, health or sexual life data
• any personal data classified as high-risk to the data subject’s rights under the laws of Tanzania

Processing sensitive personal data generally requires prior consent, subject to limited exceptions.