Tanzanian law treats attacks on computer systems as crimes, but the law cannot restore your data. Prevention is your responsibility.
The Cybercrimes Act, 2015
Tanzania's Cybercrimes Act (Act No. 14 of 2015) was signed into law in April 2015. It applies to Mainland Tanzania and to Tanzania Zanzibar, apart from one section. It makes offences of acts such as illegal access to computer systems, interfering with data and computer-related fraud, and it sets out the liabilities of service providers.
The Personal Data Protection Act 2022 adds duties to protect personal data and to report breaches to the Personal Data Protection Commission.
What attacks look like locally
Most incidents we see are not sophisticated. They are:
- Phishing emails and fake payment messages.
- Stolen or reused passwords for email and social media.
- Ransomware that encrypts office files.
- Unsecured CCTV recorders and routers with default passwords.
- Former staff who still have access.
Plays from YouTube when you press play.
Ten controls every organisation needs
- Individual accounts for every person, never shared logins.
- Two-step sign-in on email, banking and admin accounts.
- Removing access the day someone leaves.
- Updates for computers, phones, routers and firewalls.
- Backups kept separate from the main systems, and tested.
- A firewall and separate networks for staff, guests and CCTV.
- Changed default passwords on every device.
- Antivirus or endpoint protection on all computers.
- Staff training on phishing and payment fraud.
- A simple incident plan: who to call and what to do first.
Score your organisation with our free cybersecurity checklist, and check how staff connect from home with the remote access safety check.
Report and recover
If you are attacked, disconnect affected devices, preserve evidence such as logs and messages, change passwords from a clean device and report to the police. If personal data is affected, consider your duty to notify the PDPC.
How Extrion can help
Extrion runs security assessments, hardens networks and devices, sets up backups and trains staff. See our security auditing and risk service, backup and disaster recovery, or book a consultation.
Frequently asked questions
Does the Cybercrimes Act apply in Zanzibar?
Yes. The Cybercrimes Act, 2015 applies to Mainland Tanzania and Tanzania Zanzibar, with the exception of one section.
What should we do first after a cyber attack?
Disconnect affected devices, preserve evidence, change passwords from a clean device, report to the police, and check whether personal data was affected.
Still stuck, or want more detail?
Ask for clarification, tell us a problem this did not solve, or suggest a topic. An engineer reads every message, and we use them to improve the Knowledge Center.
Last updated
Talk to Extrion about this topic
Book a consultation and we will help you map a practical next step.
