In this month's legal briefing, we cover the requirement for banks and financial institutions to locate their primary or secondary data centres in Tanzania. This requirement is detailed in the Bank of Tanzania (the BoT) circular number FA.56/293/01/54 (the Circular) issued on 23 August 2019.
In summary the Circular requires that all banks and financial institutions in Tanzania do the following:
- put in place a primary or secondary data centre
- within seven working days from the date of issuance of the circular re-confirm the location of the data centres, compliance status and prepare for the centres to be tested
- within 3 months from the date of issuance of this circular establish a primary data centre
Non-compliance with 1. and 2. above attracts a penalty of TZS 5 billion and TZS 500 million for every month of the recurring offence.
The circular is to be read together with circular number FA.56/293/043/VOL.III/28 issued on 3 March 2014, FB.44/475/01/35 issued on 29 February 2016 and FA.56/235/20/29 issued on 10 July 2019. Copies of these circulars can be found on the Bank of Tanzania website.
A data centre is a data storage facility where banks and financial institutions store all their operational data including client data and information on account transactions / deposits etc. A primary data centre is the main storage facility while a secondary data centre is a data recovery site capable of sustaining operations in case the primary data centre is inaccessible.
Location of primary and secondary data centres
Circular FA.56/293/043/VOL.III/28 required all banks and financial institutions that had both primary and secondary data centres outside Tanzania to relocate one of them to Tanzania. This would enable the BoT to effectively supervise, have access to data and the opportunity to test the facilities. A one month period was given to decide and inform the BoT the data centre that was going to be re-located. A two year period was then given for the actual re-location.
Circular FB.44/475/01/35 made reference to the above circular and advised banks and financial institutions intending to establish secondary data centres in Tanzania to ensure that data replication did not go beyond 'End of Day' processing and extended the deadline to relocate from 3 March 2016 to 31 March 2017. Additionally those intending to relocate were also required to submit a quarterly progress report.
So far two banks have been penalised for failing to have either their primary or secondary data centres located in Tanzania.