Tanzania

Tanzania regulates personal data through the Personal Data Protection Act, 2022 (Act No. 11 of 2022), its first standalone comprehensive data protection statute, passed on 27 November 2022 and in force from 1 May 2023, the same date its supervisory commission was established. The Act covers any person, institution, or public body collecting or processing personal data in Tanzania, and reaches entities outside the country processing the personal data of individuals located there; purely personal or household processing and specified law-enforcement processing are exempt. All data collectors and processors must register with the supervisory commission before operating (registration certificates valid five years; the deadline for existing operators was 30 April 2025), and unregistered processing is a criminal offence. Data subjects hold rights of access, rectification, erasure, restriction, and objection. Controllers must build in data protection by design, maintain appropriate security measures, and, where required by subsidiary regulations, appoint Data Protection Officers and conduct DPIAs for high-risk processing. Cross-border transfers are permitted to jurisdictions with adequate frameworks or in specified exceptional circumstances. Administrative fines reach TZS 100 million, and criminal liability for misuse can reach ten years' imprisonment or fines up to TZS 20 million. Enforcement rests with the Personal Data Protection Commission (PDPC), headquartered in Dar es Salaam and established on 1 May 2023, which registers collectors and processors, investigates complaints, conducts audits, assesses cross-border adequacy, and enforces compliance. With a recent in-force Act and a newly operational regulator, Tanzania has a working regime, though enforcement is still early-stage and several operational details depend on subsidiary regulations.