Tanzania Data Privacy Laws: PDPA 2022 Guide (2026)

Tanzania governs personal data under the Personal Data Protection Act No. 11 of 2022 (in force 1 May 2023). The Act mandates registration with the Personal Data Protection Commission, a mandatory Data Protection Officer under Section 27(3), and lawful-processing compliance, backed by criminal fines, imprisonment, and administrative penalties of up to TZS 100 million.

Tanzania's Personal Data Protection Act of 2022 is now fully enforced. The Personal Data Protection Commission launched in April 2024, spent its first year building registration systems and issuing guidance, and commenced active enforcement on 9 April 2026 after successive deadline extensions failed to achieve full sector compliance. This guide covers every layer of Tanzania's data protection framework, from the constitutional foundations through the April 2026 enforcement milestone and the emerging case law.

For questions about recording consent laws in Tanzania, see the companion article on Tanzania recording laws.

Jurisdiction scope: This article addresses Tanzania's national data protection framework under the Personal Data Protection Act No. 11 of 2022 (Mainland Tanzania and, for Union Matters only, Zanzibar), the Electronic and Postal Communications Act 2010, and the Cybercrimes Act 2015. It does not address broader East African Community harmonization proposals or the laws of other EAC member states except for brief comparative context.

Quick Answer: Tanzania's Data Protection Framework

Tanzania's primary data protection law is the Personal Data Protection Act (PDPA), No. 11 of 2022. It came into force on 1 May 2023 and is enforced by the Personal Data Protection Commission (PDPC), which launched on 3 April 2024. The PDPA requires registration of all data controllers and processors, mandatory appointment of a Data Protection Officer, and compliance with lawful processing, data subject rights, and cross-border transfer rules. As of 9 April 2026, the PDPC began active enforcement against unregistered institutions, and on 28 August 2026 it began nationwide on-site inspections. Failing to register is an offence under Section 19, punishable under Section 63 by a fine of TZS 100,000 to TZS 5 million, imprisonment of up to five years, or both. The Act applies to Mainland Tanzania and to Zanzibar only for Union Matters. Two provisions (section 22(3) and section 23(3)(c) and (e)) were found unconstitutionally vague by the High Court in May 2024 and ordered amended within one year; no amendment was enacted before that window lapsed in May 2025, and the National Assembly's acts index still lists none.

Constitutional Right to Privacy

The foundation of data protection in Tanzania rests on Article 16 of the Constitution of the United Republic of Tanzania, 1977. This article establishes the fundamental right to privacy that all subsequent data protection legislation builds upon.

Article 16(1) states that every person is entitled to respect and protection of their person, the privacy of their own person, their family and matrimonial life, and respect and protection of their residence and private communications.

Article 16(2) adds an important qualification. Any interference with a person's privacy must be justified and carried out in accordance with procedures laid down by law. This means the government cannot intrude on personal privacy without legal authority.

Legal scholars and courts have interpreted Article 16 as extending to personal data in digital environments. The passage of the PDPA in 2022 represents the legislative operationalization of this constitutional guarantee, giving the privacy right concrete rules and enforcement mechanisms in the digital age.

The Personal Data Protection Act of 2022

The Personal Data Protection Act (PDPA) No. 11 of 2022 is Tanzania's primary and most comprehensive data protection legislation. President Samia Suluhu Hassan signed the Act on 27 November 2022, and it came into force on 1 May 2023.

The PDPA applies to all processing of personal data within Tanzania, whether by automated or manual means. It also applies to data controllers and processors outside Tanzania who process personal data of individuals located in the country.

Core Data Protection Principles

The PDPA establishes several foundational principles that govern all personal data processing in Tanzania.

Personal data must be processed lawfully, fairly, and transparently. Controllers must ensure the security of personal data throughout processing. Data may only be collected for explicit, specified, and legitimate purposes and must not be further processed in ways contrary to those original purposes.

Data must be adequate, relevant, and limited to what is necessary for the purposes for which it is collected. Personal data must be accurate and, where necessary, kept up to date. Controllers must take reasonable steps to ensure inaccurate data is erased or rectified without delay.

Personal data should not be kept longer than is necessary for the purposes for which it was collected. Controllers must implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

Lawful Bases for Processing

The PDPA provides several lawful grounds for processing personal data. Data controllers must rely on at least one of these grounds.

Consent of the data subject is the primary basis. The consent must be specific, informed, and freely given. For sensitive personal data, controllers must obtain prior written consent from the data subject.

Other lawful grounds include contractual necessity, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest, and legitimate interests of the controller or a third party (provided these do not override the data subject's rights).

Data Controllers and Processors

The PDPA distinguishes between data controllers and data processors. A data controller determines the purposes and means of processing personal data and bears primary compliance obligations, including registration, DPO appointment, and data subject rights management. A data processor processes personal data on behalf of a controller and must follow the controller's instructions and implement appropriate security measures. Section 27(4) makes the processor responsible, under its contract with the controller, for complying with the security standards the Act sets. Breach notification to the controller and records of processing are terms the controller should write into that contract rather than free-standing statutory duties.

Controllers who engage processors must do so under a written contract that binds the processor to the controller's data protection obligations.

Data Subject Rights

The PDPA grants data subjects a comprehensive set of rights that align broadly with international standards.

The right to be informed requires controllers to provide clear information about data processing activities, including the purposes of processing, the categories of data collected, and the identity of the controller.

The right of access allows data subjects to obtain confirmation of whether their personal data is being processed and to access copies of that data.

The right to rectification enables data subjects to request correction of inaccurate personal data.

The right to erasure (sometimes called the right to be forgotten) allows data subjects to request deletion of their personal data under certain circumstances.

The right to restrict processing permits data subjects to limit how their data is used.

There is no right to data portability in Tanzania. Part VI of the PDPA sets out the rights of data subjects at Sections 33 to 38, and portability is not among them. Section 34 instead lets a data subject require the controller, through the procedures prescribed in the Regulations, to suspend or not begin processing that is likely to cause substantial damage to the data subject or to another person, subject to the exceptions the section preserves.

The right to object gives data subjects the ability to oppose certain types of processing, including processing for direct marketing purposes.

The right not to be subjected to automated decision-making protects data subjects from decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant impacts.

Sensitive Personal Data

The PDPA provides heightened protections for sensitive personal data, and Section 3 defines the category more broadly than the GDPR does.

It covers genetic data, data related to children, data related to offences, the financial transactions of the individual, security measures, and biometric data.

It also covers, where they are processed for what they reveal, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, affiliation, trade-union membership, gender, and data concerning health or sex life. A catch-all limb adds any personal data that other Tanzanian laws treat as presenting a major risk to the rights and interests of the data subject.

Note the practical consequence for banks, insurers, microfinance institutions, and fintechs. An individual's financial transaction data is sensitive personal data in Tanzania, so Section 30(1) requires prior written consent before it is processed, subject to the exceptions in Section 30(5).

Processing sensitive data requires prior written consent from the data subject and is subject to additional safeguards. Controllers processing sensitive data must implement enhanced security measures and may face stricter penalties for violations.

Data Protection Officers

Section 27(3) of the PDPA requires every data controller and data processor to appoint a Data Protection Officer (DPO). Section 3 defines a DPO as "an individual appointed by the data controller or data processor charged with ensuring compliance with the obligations provided for in the Act."

Unlike the EU's General Data Protection Regulation (GDPR), which exempts small organizations and certain processing types from the DPO requirement, the PDPA sets no organizational size thresholds or processing volume criteria. Every entity that qualifies as a controller or processor under the Act must have a DPO, regardless of scale.

DPO Responsibilities

The DPO's core duties under the PDPA and its regulations include:

• Monitoring the organization's compliance with the PDPA, its regulations, and internal data protection policies
• Identifying and reporting data protection violations and advising on corrective action
• Serving as the primary point of contact between the organization and the PDPC
• Managing data subject requests, complaints, and access requests
• Overseeing Data Protection Impact Assessments for high-risk processing activities
• Developing and delivering employee training and awareness programs
• Submitting quarterly compliance reports to the PDPC

Internal or External DPO

The DPO may be an internal employee or an external professional, provided that person has independence and sufficient understanding of the organization's data processing activities. Where a DPO is an internal employee, the organization must ensure the DPO's data protection role does not create a conflict of interest with other duties.

The PDPC has run training programs for DPOs across Tanzania since its launch, reflecting the importance the Commission places on building a competent DPO community.

The Personal Data Protection Commission (PDPC)

The PDPA establishes the Personal Data Protection Commission (PDPC) as the independent supervisory authority responsible for overseeing compliance with data protection law in Tanzania.

Establishment and Launch

The PDPC was officially launched on 3 April 2024, marking the beginning of active data protection enforcement in Tanzania. The Commission operates as an independent corporate body with its own legal personality.

The PDPC is headed by a Director General (Dr Emmanuel Lameck Mkilia as of 2026) and a Commissioner appointed by the President, supported by staff with expertise in data protection, information technology, and law.

Powers and Functions

The PDPC holds broad regulatory and enforcement powers. It is mandated to monitor compliance with the PDPA and its regulations, register data controllers and processors, receive and investigate complaints of alleged violations, conduct inspections and audits, issue guidance and codes of practice, and impose administrative penalties.

The Commission can issue enforcement notices directing violators to remedy breaches within a specified period. If the violation is not remedied, the Commission can issue penalty notices with financial sanctions.

The PDPC also has the power to order the deletion of personal data if a controller or processor is found in violation of the PDPA.

Registration Requirements

All organizations that process personal data in Tanzania must register with the PDPC. Registration requires providing details about data processing activities, the types of personal data handled, the identity of the appointed DPO, and the security measures in place. Upon approval, the PDPC issues a certificate of registration valid for five years.

The registration deadline went through three stages: a presidential grace period running to 31 December 2024 (announced by President Samia Suluhu Hassan at the PDPC launch on 3 April 2024), a first extension to 30 April 2025 announced by the PDPC on 10 January 2025, and a final extension to 8 April 2026 announced by Minister Angella Jasmine Mbelwa Kairuki on 8 January 2026. Dr Mkilia confirmed at a press conference in Dodoma on 26 March 2026 that full enforcement would commence on 9 April 2026 with no further extensions.

Sectors specifically targeted for enforcement include government ministries and agencies, banks, insurance companies, microfinance institutions, educational and healthcare facilities, telecommunications companies and internet service providers, e-commerce platforms, data centres, manufacturing, transport, tourism, legal and accounting firms, media outlets, political parties, and religious organizations.

Enforcement and Complaints

The PDPC follows a structured enforcement procedure. When a violation is identified, the Commission first issues an enforcement notice directing the violator to remedy the breach within a specified period. If the violation is not remedied within the given timeframe, the Commission may issue a penalty notice imposing financial sanctions.

The Commission may also order compensation to data subjects who suffered harm due to violations. This compensation mechanism provides a direct remedy for individuals affected by data protection breaches.

Zanzibar and the PDPA

The PDPA's territorial scope is defined in Section 2, which provides that the Act "shall apply to Mainland Tanzania as well as Tanzania Zanzibar, except that in Tanzania Zanzibar, the Act does not apply to non-union matters."

The Union Matters Framework

Tanzania's constitutional structure reflects the 1964 merger of the Republic of Tanganyika and the People's Republic of Zanzibar. The Constitution of the United Republic of Tanzania, 1977 divides governmental authority between Union Matters (listed in the First Schedule) and non-union matters, which remain subject to Zanzibar's own governance.

The First Schedule identifies 22 Union Matters, including: the national constitution and government of the United Republic; foreign affairs and defence; citizenship and immigration; banking, currency, and exchange control; customs duties; income tax; posts and telecommunications; civil aviation; higher education; mineral oil and natural gas; meteorology; statistics; and registration of political parties.

Practical Implications for Businesses in Zanzibar

A business operating in Zanzibar must assess whether its data processing activities relate to Union Matters. If the activity touches a Union Matter (for example, telecommunications, banking, or customs), the PDPA applies in full. If the activity is a purely non-union matter under Zanzibar's jurisdiction (for example, local land registry administration), the PDPA may not apply.

Zanzibar does not currently have its own separate data protection legislation. The PDPC has indicated that further guidance on the Act's application in Zanzibar will be issued. Until that guidance is published, businesses operating in Zanzibar should seek qualified legal advice on whether their specific processing activities fall within the Union Matters scope.

Watch out: The Union Matters limitation is not a blanket Zanzibar exemption. Most commercial data processing activities -- banking, telecommunications, insurance, e-commerce -- touch Union Matters and are therefore subject to the PDPA in Zanzibar.

Penalties and Enforcement

The PDPA and related enforcement actions establish a tiered penalty structure that includes both administrative and criminal sanctions.

Penalty Summary Table

Compensation for Data Subjects

There is no ceiling on the compensation the PDPC can award to affected data subjects. Organizations could face significant financial exposure beyond the administrative fine caps through compensation orders.

Enforcement Process

When a violation is identified, the Commission first issues an enforcement notice directing the violator to remedy the breach within a specified period. If the violation is not remedied, the Commission issues a penalty notice imposing financial sanctions. The Commission may also order data deletion and compensation to affected data subjects.

The Electronic and Postal Communications Act (EPOCA) 2010

Before the PDPA, the Electronic and Postal Communications Act (EPOCA) of 2010 served as one of the primary instruments for data protection in Tanzania's telecommunications sector. EPOCA remains in force and provides sector-specific protections that supplement the PDPA.

Confidentiality Obligations

Section 98 of EPOCA imposes a duty of confidentiality on licensees of network services and their agents who may encounter personal information of customers. This means telecommunications operators, internet service providers, and their employees cannot disclose customer data without authorization.

Section 99 extends this prohibition further, restricting the disclosure of subscriber information by service providers. Information may only be disclosed when required by law enforcement, a court of law, or another lawfully constituted tribunal.

Protection Against Interception

Section 120 of EPOCA prohibits unlawful interception of communications. This provision protects individuals from unauthorized monitoring or surveillance of their electronic communications, including phone calls, text messages, and internet activity.

Violations of these interception prohibitions carry significant penalties, reinforcing the importance the Tanzanian legislature places on communications privacy.

Consumer Protection Regulations

The Electronic and Postal Communications (Consumer Protection) Regulations of 2018, made under EPOCA, require licensees to protect consumer information against improper or accidental disclosure. Regulation 6 specifically addresses the duty to safeguard personal data collected in the course of providing communications services.

Cross-Border Data Transfers Under EPOCA

EPOCA restricts transfers of personal data (including transfers outside Tanzania) by electronic communications and postal services licensees. Such data may only be transferred if the transfer is in accordance with terms agreed with the data subject and either the Tanzania Communications Regulatory Authority (TCRA) has approved the transfer or the transfer is required by applicable law.

These provisions gave Tanzania an early framework for controlling international data flows, which the PDPA has since expanded to cover all sectors.

SIM Card Registration and Biometric Data

The Electronic and Postal Communications (SIM Card Registration) Regulations of 2020 require SIM card registration using biometric data. Under Regulation 20, licensees, dealers, and their agents are prohibited from misusing registered data. Violations carry penalties of not less than TZS 5 million or imprisonment for at least 12 months, or both.

This biometric registration requirement makes EPOCA relevant to discussions about mass data collection and surveillance, as it means the government holds biometric identifiers for a large portion of the population.

The Tanzania Communications Regulatory Authority (TCRA)

The TCRA is the regulatory authority responsible for overseeing the postal, electronic communications, and broadcasting industries in Tanzania. While the PDPC now handles general data protection oversight, the TCRA retains an important role in sector-specific data protection for telecommunications.

Regulatory Functions

The TCRA is tasked with promoting effective competition and economic efficiency while safeguarding the interests of consumers in the communications sector. Its data protection responsibilities include enforcing the confidentiality provisions of EPOCA, overseeing SIM card registration compliance, maintaining the Central Equipment Identification Register (CEIR), and approving cross-border data transfers by telecommunications licensees.

Under Section 84 of EPOCA, the TCRA must establish and maintain the CEIR, which contains information about all devices collected by licensees from their subscribers, including mobile numbers and International Mobile Equipment Identity (IMEI) numbers.

Relationship with PDPC

Since the establishment of the PDPC, a regulatory overlap exists between the two bodies. The TCRA handles sector-specific telecommunications data protection under EPOCA, while the PDPC oversees general data protection under the PDPA. Organizations in the telecommunications sector must comply with both regulatory frameworks.

The Cybercrimes Act 2015

The Cybercrimes Act of 2015 was enacted on 25 April 2015 and addresses criminal offenses related to computer systems, networks, and electronic data. While primarily a criminal statute, it contains provisions relevant to data protection.

Data Protection Provisions

The Cybercrimes Act provides penal sanctions to deter privacy and data protection abuses. Service providers face restrictions on monitoring customer data and must follow prescribed procedures for sharing information with authorities.

The Act criminalizes unauthorized access to computer systems and data, illegal interception of data transmissions, and unauthorized disclosure of protected information. These provisions create criminal liability for data breaches that go beyond accidental loss or negligence.

Section 16 of the Cybercrimes Act is sometimes described as a CCTV provision. It is not. Section 16 is headed "Publication of false information" and punishes publishing false, deceptive, misleading, or inaccurate information in a computer system, with a fine of not less than TZS 5 million or imprisonment for not less than three years, or both. The word camera appears in the Act only in the phrase "in camera", meaning closed proceedings.

Neither the Cybercrimes Act nor the PDPA creates a separate CCTV registration offence, a signage duty, or a camera-siting rule. An organisation whose cameras capture personal data is a data controller, so Section 14 of the PDPA requires it to be registered like any other controller, and failing to register is an offence under Section 19.

Criticisms and Concerns

The Cybercrimes Act has faced significant criticism from civil society and rights organizations. Critics argue that the Act grants law enforcement excessive surveillance powers with insufficient judicial oversight.

The Act authorizes the Minister responsible for information and communication technology to require service providers to inform authorities of alleged illegal activities and provide customer identity information. Search and seizure powers under the Act are broad, raising concerns about potential abuse.

Rights groups contend that while the Cybercrimes Act purports to protect data, some of its provisions may actually facilitate government surveillance and undermine individual privacy rights.

Implementing Regulations

The PDPA is supported by several implementing regulations issued in 2023 that provide detailed procedural requirements.

Personal Data Collection and Processing Regulations 2023

The Personal Data Protection (Personal Data Collection and Processing) Regulations, GN No. 449C of 2023, came into effect on 4 July 2023. These regulations detail how data controllers and processors must handle personal data, including requirements for privacy notices, consent mechanisms, data retention policies, and security measures.

Complaints Settlement Procedures Regulations 2023

The Personal Data Protection (Complaints Settlement Procedures) Regulations of 2023 establish the process for filing and resolving data protection complaints with the PDPC. They outline how data subjects can bring complaints, the investigation procedures the Commission will follow, and the remedies available.

Cross-Border Transfer Requirements

The regulations establish detailed requirements for transferring personal data outside Tanzania. The Act sets out two routes, not one.

Section 31 governs transfers to a country whose legal framework already provides adequate data protection. Section 32 governs transfers to other countries, which are permitted where an adequate level of protection is ensured in the recipient country and the personal data is transferred solely to permit processing the controller is authorised to undertake. Section 32(2) lists the factors used to assess adequacy in that second case. The PDPC's own August 2026 inspection notice names both sections.

The regulations outline the permit application process under Regulation 20. Data controllers must demonstrate that the recipient country has ratified an international agreement providing data protection requirements, a bilateral agreement exists between Tanzania and the recipient country, or a contractual agreement between the applicant and the foreign recipient provides adequate protections.

The permit decision rests with the Commission, not the Minister. Regulation 20(4) requires the Commission to consider an application within fourteen days, then accept or reject it and either issue a permit in Form No. 8 or give written reasons for the rejection. Regulation 21 sets out the grounds for rejection, which include a threat to national security, inadequate protection of personal data in the recipient country, and restrictions imposed by other written laws. Even when the formal conditions are met, approval is not guaranteed, which gives Tanzanian authorities significant control over international data flows.

Data Breach Notification

Section 27(5) requires the data controller to notify the Commission "without any undue delay" of any security breach affecting personal data processed by or on behalf of the controller. A security breach encompasses negligent loss or unauthorized modification, destruction, disclosure, access, or processing of personal data.

The Act imposes no express duty on a processor to notify its controller. Section 27(4) makes the processor responsible for meeting the Act's security standards under its contract with the controller, so a breach-notification term is something the controller should require by contract.

The PDPA does not specify a fixed notification timeline, in contrast to frameworks such as the GDPR's 72-hour window. The statutory standard is "without any undue delay", and no PDPC guidance defines what that means in practice as of September 2026. Organizations are advised to treat 72 hours as a working target until the PDPC issues specific guidance.

Controllers must also maintain breach detection, handling, and response procedures as part of their security obligations under the PDPA.

Recent Developments (2024-2026)

PDPC Launch (April 2024)

The Personal Data Protection Commission was formally launched on 3 April 2024, approximately 11 months after the PDPA came into force. The launch marked the transition from legislation-on-paper to active regulatory oversight, with the PDPC beginning to accept registrations, issue guidance, and build its enforcement capacity.

Constitutional Challenge: Magoti v. Attorney General (May 2024)

On 8 May 2024, the High Court of Tanzania in Dar es Salaam issued a significant ruling on the constitutionality of the PDPA. Human rights advocate Tito Magoti petitioned the court challenging 13 provisions of the Act as incompatible with fundamental rights under the Constitution.

The three-judge panel ruled that most sections were constitutional but identified two provisions as unconstitutionally vague:

• Section 22(3) (on unlawful means for collecting and processing personal data): the court found the provision "wide and vague" with a "lack of clarity" about what acts or omissions constitute unlawful collection.
• Section 23(3)(c) and (e) (exceptions to the Section 23(1) duty to collect personal data directly from the data subject, for cases where compliance is not reasonably practicable or would prejudice the lawful purpose of the collection): the court found the provision "ambiguous, unclear and without prescribed procedures."

The court ordered the government to amend both provisions within one year to provide "certainty as to what acts or omissions shall be regarded as unlawful." If the amendments were not completed, those provisions were to be struck from the law.

No amendment has been enacted. The National Assembly's index of acts lists no Personal Data Protection (Amendment) Act, and neither the Written Laws (Miscellaneous Amendments) Act 2025 nor the Written Laws (Miscellaneous Amendments) (No. 2) Act 2025 touches the PDPA. The one-year window therefore lapsed on 8 May 2025 with both provisions unamended, and on the terms of the judgment Section 22(3) and Section 23(3)(c) and (e) fall away.

Two cautions belong with that. The PDPC still publishes the unamended text of the Act, and no repeal notice has been gazetted for either provision. Anyone whose position turns on the status of those subsections should take Tanzanian legal advice rather than assume the outcome either way.

Registration Deadline Extensions and Final Enforcement (2024-2026)

The PDPA's registration requirement went through four enforcement milestones before active penalties began:

1. December 31, 2024: initial grace period set by President Samia Suluhu Hassan at the PDPC launch on 3 April 2024. All public and private sector data controllers and processors were directed to register by year-end 2024.
2. April 30, 2025: first extension, announced by PDPC Director General Dr Mkilia on 10 January 2025 to allow more time for compliance infrastructure to reach smaller organizations.
3. April 8, 2026: final deadline, announced on 8 January 2026 by Minister Angella Jasmine Mbelwa Kairuki at a DPO training ceremony in Arusha. Minister Kairuki stated: "No exemptions will be granted, and enforcement actions will be taken against all offenders."
4. April 9, 2026: PDPC Director General Dr Emmanuel Lameck Mkilia confirmed full enforcement began, with compliance audits planned across all targeted sectors.

DPO Training Programs

Since its launch, the PDPC has run a series of Data Protection Officer training programs across Tanzania. These programs reflect the Commission's approach to building compliance culture before escalating to punitive enforcement, and the DPO training appears to have preceded the final enforcement deadline.

Nationwide Compliance Inspections (August 2026)

On 28 August 2026, PDPC Director General Dr Emmanuel Mkilia announced in Dodoma that the Commission had begun visiting institutions, organisations, and businesses that collect and process personal data, to check compliance with the Act on site.

The Commission said inspectors will look at whether the organisation appears in the Commission's register, whether the Data Protection Officer is actually carrying out the duties set by Regulation 32, and how personal data is collected, processed, and stored.

Inspectors will also review how personal data is transferred out of the country, measured against the conditions in Sections 31 and 32, and the steps taken under Section 27(1) to protect personal data against loss, destruction, alteration, and processing without authorisation.

The PDPC said legal action, including penalties and fines, will follow for organisations found not to meet the requirements of the law.

Tanzania in the East African Data Protection Landscape

Tanzania's data protection framework exists within the broader context of rapidly evolving privacy regulation across East Africa.

Regional Comparison

All major East African Community members have now adopted data protection legislation modeled in part on the GDPR. Kenya's Data Protection Act of 2019, Uganda's Data Protection and Privacy Act of 2019, and Tanzania's PDPA of 2022 share common features including independent supervisory authorities, consent-based processing models, and restrictions on cross-border transfers.

Kenya currently leads the region in data protection enforcement maturity, with its Office of the Data Protection Commissioner (ODPC) having been operational since 2020. Uganda's Personal Data Protection Office operates under the National Information Technology Authority. Tanzania's PDPC, while newer, moved quickly to establish registration requirements and began enforcement in 2026.

Harmonization Challenges

Despite the similarities in their legislative frameworks, the three East African nations differ in scope, provisions, and enforcement capacity. A unified approach across the East African Community has not yet emerged, creating compliance challenges for organizations operating across borders in the region.

Regional collaboration is growing. Tanzania has participated in knowledge-sharing initiatives with other African data protection authorities, and there are ongoing discussions about developing common standards within the EAC.

African Union Convention

Tanzania is also influenced by the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention), adopted in 2014. While ratification across the continent has been slow, the convention provides a continental framework that shapes national legislation in AU member states, including Tanzania.

Practical Compliance Guidance

Organizations operating in Tanzania or processing the personal data of Tanzanian residents should address each of the following areas.

Registration

The 8 April 2026 registration deadline has passed. Any organization that has not yet registered with the PDPC is now operating illegally and faces enforcement action. On 28 August 2026 the Commission began nationwide on-site inspections, checking entry in the register, the Data Protection Officer's performance of the Regulation 32 duties, collection and storage practice, cross-border transfers under Sections 31 and 32, and the Section 27(1) security measures. Registration requires providing details about your data processing activities, categories of data processed, the identity of your DPO, and security measures in place. Certificates of registration are valid for five years.

Data Protection Officer Appointment

Appoint a DPO under Section 27(3) of the PDPA if you have not already done so. The DPO may be an internal employee or an external professional. Document the appointment, define the DPO's independence, and ensure the DPO has access to the PDPC's training resources. DPOs must submit quarterly compliance reports to the PDPC.

Consent Mechanisms

Review and update consent collection practices. Consent must be specific, informed, and freely given. For sensitive personal data, written consent is mandatory. Separately, review any practice of obtaining personal data from third parties rather than from the data subject. Section 23(1) requires direct collection, and the exceptions in Section 23(3)(c) and (e) are the ones the High Court found unconstitutionally vague in May 2024. No amendment has followed, so take Tanzanian legal advice before relying on either exception.

Cross-Border Transfers

If you transfer personal data outside Tanzania, confirm that you have obtained the necessary permit from the PDPC under Regulation 20 of the 2023 Regulations. Prepare documentation demonstrating that the recipient country provides adequate data protection or that appropriate contractual safeguards are in place.

Data Security

Implement appropriate technical and organizational measures to protect personal data. The PDPA requires encryption, secure storage, access restrictions, and other safeguards proportionate to the sensitivity of the data you process. DPOs should oversee Data Protection Impact Assessments for high-risk processing activities.

Data Subject Requests

Establish procedures for handling data subject rights requests: access under Section 33, requests to stop processing under Sections 34 and 35, objections to automated decision making under Section 36, and rectification, blocking, erasure, and destruction under Section 38. The PDPA grants no portability right, so no portability workflow is needed. Respond to requests within a reasonable timeframe.

Breach Response

Develop a data breach response plan that includes procedures for notifying the PDPC and affected data subjects. In the absence of a specific PDPC timeline, treat 72 hours as a working target. Identify the personnel responsible for managing breach responses.

CCTV Surveillance

If your organization operates CCTV cameras that capture personal data, you are processing personal data and must be registered with the PDPC under Section 14 of the PDPA. Failing to register is an offence under Section 19, carrying the Section 63 penalty.

The PDPA contains no express signage rule and no camera-siting rule, and neither does the Cybercrimes Act. Clear signage and cameras confined to your own premises remain sound practice, because Section 23(2) requires the data subject to be told why data is being collected and for what purposes.

---

Disclaimer: This article provides general legal information about Tanzania's data privacy laws as of September 2026. It is not legal advice. Data protection laws change frequently and enforcement positions evolve. Consult a qualified attorney licensed in Tanzania for guidance on your specific situation.

Frequently Asked Questions

What is Tanzania's main data protection law?

Tanzania's primary data protection legislation is the Personal Data Protection Act (PDPA) No. 11 of 2022, which came into force on 1 May 2023. It establishes comprehensive requirements for the collection, processing, storage, and transfer of personal data. The Act is supplemented by implementing regulations issued in 2023 and enforced by the Personal Data Protection Commission (PDPC), which launched on 3 April 2024 and began active enforcement on 9 April 2026.

Who enforces data protection laws in Tanzania?

The Personal Data Protection Commission (PDPC) is the primary enforcement authority. Launched on 3 April 2024, the PDPC has the power to investigate complaints, conduct audits, issue enforcement notices, impose administrative fines of up to TZS 100 million, and order compensation to affected data subjects. Failing to register is an offence under Section 19, punishable under Section 63 by a fine of TZS 100,000 to TZS 5 million, imprisonment of up to five years, or both. The TZS 1 million to TZS 5 billion band is the Section 60 penalty for a company or corporation convicted of unlawfully disclosing, obtaining, or offering personal data for sale. The Tanzania Communications Regulatory Authority (TCRA) retains a separate enforcement role for telecommunications-specific data protection under the Electronic and Postal Communications Act (EPOCA).

What are the penalties for violating data protection laws in Tanzania?

Penalties depend on the offence. Administrative penalties imposed by the Commission in a penalty notice reach up to TZS 100 million under Section 47. Failing to register, and any other contravention for which no specific penalty is provided, carries a fine of TZS 100,000 to TZS 5 million, imprisonment of up to five years, or both, under Section 63. Unlawful disclosure, unauthorised obtaining, or offering personal data for sale under Section 60 carries TZS 100,000 to TZS 20 million or up to 10 years imprisonment for an individual, and TZS 1 million to TZS 5 billion for a company or corporation. The PDPC can also order uncapped compensation payments to affected data subjects.

Does the PDPA apply in Zanzibar?

The PDPA applies to Mainland Tanzania and to Tanzania Zanzibar, but in Zanzibar only for Union Matters as defined in the First Schedule to the Constitution of the United Republic of Tanzania. Union Matters include 22 enumerated areas such as banking, telecommunications, civil aviation, customs, and immigration. Data processing activities in Zanzibar that fall outside Union Matters are not governed by the PDPA. Zanzibar does not currently have its own separate data protection legislation, and the PDPC has indicated that further clarifying guidance will be issued.

Must every organization in Tanzania appoint a Data Protection Officer?

Yes. Section 27(3) of the PDPA requires all data controllers and data processors to appoint a Data Protection Officer. There are no organizational size thresholds or exemptions. The DPO may be an internal employee or an external professional. Key DPO responsibilities include monitoring PDPA compliance, managing data subject requests, overseeing Data Protection Impact Assessments, and submitting quarterly compliance reports to the PDPC.

Can personal data be transferred outside Tanzania?

Yes, but only under strict conditions, and the Act has two routes. Section 31 covers transfers to a country whose legal framework already provides adequate data protection. Section 32 covers transfers to other countries, and allows them where an adequate level of protection is ensured in the recipient country and the data is transferred solely to permit processing the controller is authorised to undertake. Either way, data controllers must apply for a permit from the PDPC under Regulation 20 of the 2023 Regulations and show that the recipient country has appropriate international agreements, bilateral arrangements, or contractual safeguards in place. The Commission decides the application within fourteen days and may reject it on the grounds listed in Regulation 21, including a threat to national security.

What is the breach notification requirement in Tanzania?

Section 27(5) requires the data controller to notify the Commission 'without any undue delay' of any security breach affecting personal data processed by or on behalf of the controller. A breach covers negligent loss or unauthorized modification, destruction, disclosure, access, or processing of personal data. The Act imposes no express processor-to-controller notification duty, so controllers should require one by contract under Section 27(4). The PDPA does not specify a fixed number of hours for notification, unlike the GDPR's 72-hour window. Until the PDPC issues specific guidance, organizations are advised to treat 72 hours as a working target.

Were any parts of Tanzania's PDPA found unconstitutional?

Yes. On 8 May 2024, the High Court of Tanzania ruled that Section 22(3) (on unlawful means of collecting personal data) and Section 23(3)(c) and (e) (exceptions to the duty to collect personal data directly from the data subject) were unconstitutionally vague. The court ordered the government to amend both provisions within one year, failing which they were to be struck from the law. No amendment has been enacted: the National Assembly's index of acts shows no Personal Data Protection (Amendment) Act as of September 2026, so the window lapsed on 8 May 2025. The PDPC still publishes the unamended text and no repeal has been gazetted, so seek Tanzanian legal advice before relying on either provision.

Do organizations need to register with the PDPC?

Yes. The registration deadline was April 8, 2026. Organizations that have not yet registered are operating illegally and face enforcement action that began on April 9, 2026. Registration requires providing information about data processing activities, categories of personal data handled, the identity of the appointed DPO, and security measures in place. A certificate of registration, once issued, is valid for five years.