If your organisation collects names, phone numbers, IDs or payment details, Tanzania's Personal Data Protection Act applies to you. This checklist explains the main duties in plain language.
The law and the regulator
Tanzania's Personal Data Protection Act, 2022 (PDPA) came into force on 1 May 2023, supported by regulations on data collection and processing and on complaints. It is enforced by the Personal Data Protection Commission (PDPC), which became fully operational in April 2024.
This guide is a practical summary, not legal advice. For your specific situation, confirm with the PDPC or a Tanzanian lawyer.
1. Register with the PDPC
Organisations that collect or process personal data must register with the PDPC as a data controller or data processor. Registration is valid for five years. The PDPC set a final registration deadline of 30 April 2025, so any organisation that has not registered should do so now.
Plays from YouTube when you press play.
2. Appoint a data protection officer
Controllers and processors are expected to appoint a data protection officer (DPO). The DPO makes sure security controls are in place, handles requests and complaints from individuals, and submits compliance reports to the PDPC.
3. Collect only what you need, and keep it accurate
Personal data must be processed lawfully, kept accurate and limited to what is necessary for the purpose. In practice:
- Review every form, register and system that collects personal data.
- Remove fields you do not need.
- Decide how long each type of record is kept, then delete it on schedule.
4. Secure the data and report breaches
Controllers must notify the PDPC of personal data breaches, such as loss, theft, unauthorised access or accidental disclosure. That means you need to know when a breach happens:
- Use individual accounts and strong passwords, with two-step sign-in where possible.
- Limit who can see customer and staff records.
- Keep backups and test that they restore.
- Keep logs, so you can see what happened.
Our cybersecurity practices guide covers the basics.
Check your basics with our free cybersecurity checklist, and create strong passwords with the password generator.
5. Check transfers outside Tanzania
Before transferring personal data outside Tanzania, an organisation needs a permit from the PDPC and must show adequate protection or safeguards. This matters for cloud email, hosting, CRMs and AI tools based abroad. List where each system stores its data before signing up. Hosting in Tanzania can simplify this, see our web hosting.
6. Respect individuals' rights
People have rights to be informed about how their data is used, to object to processing (including profiling for advertising), and to have inaccurate data corrected or, in some cases, erased. Publish a clear privacy notice and make it easy for people to contact you.
Penalties
The PDPC can issue enforcement and penalty notices, with administrative fines of up to TZS 100 million, and it can order compensation for affected people. The Act also sets out criminal offences with heavier fines. Compliance is far cheaper than a breach.
How Extrion can help
Extrion helps organisations map their data, secure systems and networks, and put practical controls in place. See our security auditing and risk service or book a consultation.
Frequently asked questions
When did Tanzania's Personal Data Protection Act come into force?
The Personal Data Protection Act, 2022 came into force on 1 May 2023.
Do businesses need to register with the PDPC?
Yes. Organisations that collect or process personal data must register with the Personal Data Protection Commission as a data controller or processor. Registration is valid for five years.
Can we store customer data on servers outside Tanzania?
Transfers outside Tanzania need a permit from the PDPC and adequate safeguards. Check where each of your systems stores data before using it.
What are the fines under the PDPA?
The PDPC can impose administrative fines of up to TZS 100 million and order compensation for affected individuals. The Act also creates criminal offences.
Last updated
Talk to Extrion about this topic
Book a consultation and we will help you map a practical next step.
