The Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023

2. The need to conduct a data protection impact assessment. (Assessment, if there is a need for DPIA to explain if the project involves personal data that may cause significant impact, mention the impact where appropriate)

3. Brief description of the Project/Activity: (Explain clearly what the project aims to achieve and what type of processing it involves)

4. Personal Data (The type of personal data being processed)

5. Explain the Data Flow Explain the collection, use and deletion of personal data, including; where you are getting the data from; the manner in which data is collected; where the data will be stored; the period for which the data will be stored; the number of people who will be affected by the relevant activity/Project.

6. Explain how the data processing flow complies with the principles of protection of personal data: Part 2: An assessment of the necessity and proportionality of the processing operations in relation to the purpose. Assessment required and standards of assessment. Explain consideration and balance, especially the measures taken The principles of lawful processing Means of obtaining the consent If the processing of personal data is necessary to achieve your purpose? 35 Personal Data Protection (Personal Data Collection and Processing) GN. NO. 449C (Contd.) Is there another way to achieve your purpose without processing personal data? Quality of personal data Adequacy of personal data Informing the data subject about processing activities Implementation of the rights of the data subject All parties involved in the processing and their specific roles Ensure existing procedures are complied with by all parties Security of personal data processing Security of personal data before crossing the borders of the country Part 3: Measures set to deal with risks and protection, security measures and procedures to ensure the protection of personal data and compliance with the Act. Assessments of risks - Identifying personal data protection risks and assess how to address them Impacts Identification of Risk and its Details internal Risk Owner Current controls (provide details of how you currently managed the Risks) Current internal Risk Assessment further Explain steps you will take to reduce the impact/risk of the impact. Explain the owner of the risk at each step Part 5: Conclusions and Results DETAILS Consultation with the Personal Data Protection Commission (where applicable) TIPS/DIRECTIONS DPIA This will be placed under audit with: 36 Personal Data Protection (Personal Data Collection and Processing) GN. NO. 449C (Contd.) _____________ SECOND SCHEDULE _____________ (Made under regulations 4(2) and 8(2)) FEE Category Particulars Small-scale Data Controllers and Data Processors Medium-scale Data Controllers and Data Processors Large-scale Data Controllers and Data Processors Public institutions Non-commercial and religious institutions Data Controllers and Data Processors with 1- 49 employees and turnover of less than 100 million shillings per year. Data Controller or Data Processors with 50-99 employees and turnover of 100,000,000 to 500,000,000 per year. Data Controllers or Data processors with 100 employees and a turnover of 500,000,000 shillings per year Data Controller or Data Processors providing Government services (Regardless of the number of employees or income/turnover) Data Controllers or Data Processors that provide charity or religious works (Regardless of income/turnover) Registration fee (Tsh) by the Data Controller /Data Processor) (To be paid once) 100,000.00 Renewal fee (Tsh) by the Data Controller /Data Processor) (To be paid after every 5 years) 50,000.00 200,000.00 150,000.00 1,000,000.00 500,000.00 100,000.00 -500,000.00 50,000 - 300,000.00 100,000.00 50,000.00 _________________________________________ 37