Tanzania

Personal Data Protection Act, 2022 (Cap. 44; GN 395B commencement 1 May 2023) IN FORCE

commenced 2023-05-01 · Official full text ↗

Scope

Processing of personal data in Mainland Tanzania and Zanzibar by controllers/processors, including by non-residents using equipment in Tanzania.

Key obligations

Mandatory registration of controllers/processors with PDPC; Processing principles and lawful bases; Complaints Settlement Procedures Regulations 2023; Personal Data Collection and Processing Regulations 2023

DPO required

Appointment expected for significant controllers (per regulations/guidelines).

Registration

Yes: registration portal live (dataprotection.pdpc.go.tz); compliance pushes through 2025.

Cross-border transfers

Cross-border transfers require ensuring adequate protection in the recipient jurisdiction; PDPC oversight.

Breach notification

Section 27(5) ('Security of personal data'): the data controller must notify the Commission, without any undue delay, of any security breach affecting personal data processed by or on its behalf. The Act sets no separate data-subject notification clock.

Penalties

Fines and imprisonment for offences; compensation for data subjects; corporate fines scale higher.

Authority

Personal Data Protection Commission (PDPC)

Verified 2026-07-06

Access to Information Act 2016 IN FORCE