Personal Data Protection Act, 2022
tz-pdpa-2022 · Act
The Personal Data Protection Act, 2022 (Act No. 11 of 2022) is Tanzania’s first standalone comprehensive legislation governing the processing of personal data across both the public and private sectors. Passed on 27 November 2022 and published in the Special Supplement to the Government Gazette, the Act came into force on 1 May 2023 by Government Notice No. 326 of 2023, the same date on which the Personal Data Protection Commission (PDPC) was formally established to oversee its implementation. The Act applies to any person, institution, or public body that collects or processes personal data within Tanzania, and extends to entities outside the country that process personal data of individuals located in Tanzania. Processing conducted exclusively for personal or household purposes is exempt, as is processing by competent authorities for specified criminal law enforcement purposes. All data collectors and processors must register with the PDPC prior to commencing operations. Registration certificates are valid for five years and must be renewed. The deadline for registration of existing controllers and processors was 30 April 2025. Unregistered processing is a criminal offence under the Act. Data subjects enjoy rights to access their personal data, to have inaccurate data rectified, to request erasure, to restrict processing in defined circumstances, and to object to processing on grounds related to their particular situation. Controllers and processors must implement data protection by design and maintain appropriate technical and organisational security measures. Where required by subsidiary regulations, controllers must appoint Data Protection Officers and conduct data protection impact assessments for high-risk processing activities. Cross-border transfers of personal data are permitted where the destination jurisdiction has an adequate data protection legal framework, or in specified exceptional circumstances such as where the transfer is necessary for the performance of a public interest task or where the data subject’s legitimate interests are not prejudiced. The PDPC is empowered to assess the adequacy of third-country frameworks and authorise transfers subject to appropriate safeguards. Penalties for contraventions include administrative fines of up to TZS 100,000,000. Criminal liability for unlawful disclosure or misuse of personal data may result in fines ranging from TZS 100,000 to TZS 20,000,000, or imprisonment for up to ten years, or both. The PDPC, headquartered in Dar es Salaam, has powers to investigate complaints, conduct audits, issue enforcement notices, and promote public awareness of data protection rights.
- All data collectors and processors must register with the Personal Data Protection Commission (PDPC) before operating, with a registration validity of five years; the deadline for existing operators was 30 April 2025
- Data subjects have rights of access, rectification, erasure, restriction of processing, and objection to the processing of their personal data
- Cross-border transfers are permitted only to jurisdictions with adequate data protection frameworks or in specified exceptional circumstances
- Controllers undertaking high-risk processing activities must conduct data protection impact assessments and, where required by regulations, appoint Data Protection Officers
- Administrative penalties of up to TZS 100,000,000 may be imposed for contraventions of the Act
- Criminal sanctions for unlawful disclosure or misuse of personal data include imprisonment for up to ten years or fines of up to TZS 20,000,000
- The PDPC has powers to investigate complaints, conduct audits, and issue enforcement notices