AN ASSESSMENT ON GOVERNMENT RECORDS SECURITY CONTROLS ON ENHANCING CONFIDENTIALITY TO CUSTOMER RECORDS: CASE STUDY AT TANZANIA REVENUER AUTHORITY (TRA), KINONDONI REGION.

This study assessed government records security controls in enhancing the confidentiality of customer records, using the Tanzania Revenue Authority (TRA), Kinondoni Regional Office, as a case study. The research was guided by three specific objectives: examining current physical security measures, determining challenges facing security controls, and identifying possible solutions to protect customer record confidentiality. A descriptive cross-sectional research design employing a mixed-methods approach was adopted. The target population comprised 264 employees, from which a sample size of 159 respondents was derived using Slovin’s formula. Data collection was executed through structured questionnaires, semi-structured key informant interviews, and documentary observation. Quantitative data were analyzed using descriptive statistics via SPSS version 25.0, while qualitative data underwent thematic analysis. The findings revealed strong structural perimeter controls (server rooms locked, mean = 4.34) and effective role-based access control within the IT system (mean = 4.01). However, critical vulnerabilities were identified, including the absence of automated biometric access tracking (mean = 3.12) and the lack of mandatory Multi-Factor Authentication (MFA) (mean = 2.52). Operational challenges were predominantly driven by power outages and network instability (mean = 4.10), which forced manual, paper-based workarounds that bypass digital audit logs. Infrequent staff training on data privacy (mean = 2.93) also exposed the organization to human-error security risks. The study concludes that while foundational perimeter and role isolation controls exist, operational and technical gaps hinder complete alignment with the Personal Data Protection Act No. 11 of 2022 and ISO/IEC 27001:2022 standards. It is recommended that TRA deploy mandatory MFA, integrate biometric tracking, establish dedicated solar backup links to eliminate manual workarounds, and conduct mandatory quarterly data privacy training for all staff.

Type

Dissertation

Language

English

Peer review

Not peer-reviewed

Licence

All rights reserved