Data protection in Tanzania.

The Personal Data Protection Act, 2022 (No. 11 of 2022) is Tanzania's first comprehensive data protection law. It came into force on 1 May 2023 and is overseen by the Personal Data Protection Commission (PDPC), based in Dodoma.

Get started Check your readiness

In force: May 2023
Regulator: PDPC
Admin penalty: Up to TZS 100M

Supported via Kenya Hub

Dodoma

At a glance

Tanzania, in seven lines.

Law: Personal Data Protection Act, 2022 (No. 11 of 2022)
In force: 1 May 2023
Regulator: Personal Data Protection Commission (PDPC), Dodoma
Registration: Anyone collecting or processing personal data registers with the PDPC
Data protection officer: A DPO must be appointed (section 27)
Breach notification: Promptly, to the PDPC, for every breach that may affect personal data
Penalties: PDPC penalty notices up to TZS 100 million; criminal fines up to TZS 5 billion for companies; individuals up to TZS 20 million and/or 10 years

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Key obligations

What the law asks of you.

Four obligations organisations in Tanzania meet first, and where we help with each.

Register with the PDPC

Anyone who collects or processes personal data in Tanzania registers with the Commission.

DPO360 helps with

Registration and licensing filings with national data protection authorities

Appoint a Data Protection Officer

Data controllers and processors appoint a DPO, whose details form part of the registration.

DPO360 helps with

Formal DPO appointment and mandate definition, where permitted by law

Notify every breach promptly

Security breaches that may affect personal data are notified promptly to the PDPC.

DPO360 helps with

Incident and breach logging, escalation and regulator notification

Transfers abroad

Transferring personal data outside Tanzania requires a permit from the Commission, and adequate protection or safeguards.

DPO360 helps with

Cross-border data transfer governance: legal basis, safeguards and approvals

How the framework came together

From the law to the regulator.

1 May 2023
The Act comes into force
The Personal Data Protection Act, 2022 takes effect and the Personal Data Protection Commission is established.
April 2024
The PDPC is fully operational
Regulations on collection and processing and on complaints were published in 2023, and the Commission becomes fully operational.
2026
Enforcement begins
The PDPC set a registration deadline of 8 April 2026, began full enforcement from 9 April, and started on-site compliance inspections on 31 August 2026.

PDPC

Regulatory authority

Personal Data Protection Commission (PDPC)

A body corporate established by the Act to oversee compliance, register data collectors and processors, handle complaints and enforce data protection principles.

Dr. Emmanuel Mkilia, Director General

Visit the website

What the PDPC does

Registers collectors and processors
Anyone collecting or processing personal data in Tanzania registers with the Commission.
Handles complaints
Receives, investigates and handles complaints about breaches of data protection.
Enforces the Act
Enforces the Act, and can cancel a certificate of registration.

Penalties

What non-compliance can cost.

Administrative penalties

TZS 100M

up to, PDPC penalty notice

The Commission can issue a penalty notice of up to TZS 100 million for contraventions of the Act.

Criminal offences

TZS 5bn

up to, fine for companies

Unlawful disclosure carries a fine of TZS 1 million to TZS 5 billion for companies. Individuals face TZS 100,000 to TZS 20 million and/or up to 10 years' imprisonment.

Readiness check

Where do you stand?

Tick what is already in place. A quick read on where you stand in Tanzania, for orientation only.

0/6

Plenty to tighten.

A short scoping call will map the gaps and the order to close them.

Close the gaps with us

We are registered with the PDPC.Registration comes before collecting or processing.
A Data Protection Officer is appointed.Details of the DPO form part of registration.
We can notify the PDPC promptly of any security breach.Every breach that may affect personal data is notified.
Transfers abroad have the required permit and safeguards.Transfers need the Commission's permit.
Our consent and privacy practices are documented.Documentation supports every obligation.
We have impact assessments and records for high-risk processing.High-risk processing needs extra care.

Compare

Eight countries at a glance.

Tap a country to highlight its column. Scroll sideways for the rest.


Law	Protection of Personal Information Act (POPIA)	Data Protection Act, 2019	Nigeria Data Protection Act (NDPA), 2023	Data Protection and Privacy Act, 2019	Personal Data Protection Act, 2022	Law No. 058/2021	Data Protection Act, 2021	Data Protection Act, 2024
In force	July 2021 (most provisions from July 2020)	November 2019	June 2023	May 2019 (regulations March 2021)	May 2023	October 2021 (full compliance October 2023)	April 2021	June 2024
Regulator	Information Regulator	Office of the Data Protection Commissioner (ODPC)	Nigeria Data Protection Commission (NDPC)	Personal Data Protection Office (PDPO)	Personal Data Protection Commission (PDPC)	National Cyber Security Authority (NCSA)	Office of the Data Protection Commissioner	Malawi Communications Regulatory Authority (MACRA)
Registration	Register your Information Officer with the Regulator	Mandatory above thresholds, and in certain sectors, with the ODPC	Controllers and processors of major importance register with the NDPC	Every data collector, processor and controller registers with the PDPO	Collectors and processors register with the PDPC	Controllers and processors register with the NCSA	No one may act as a controller or processor without registering	Controllers and processors of significant importance register with MACRA
Data protection officer	Information Officer required for every organisation	May be designated; relevant for public bodies, large-scale monitoring and sensitive data	Mandatory for controllers of major importance	A DPO must be designated by the head of the institution	A DPO must be appointed	Required in certain cases (large-scale monitoring or sensitive data)	A DPO must be appointed, under the Commissioner's guidelines	Required for public authorities, and for large-scale monitoring or sensitive data
Breach notification	As soon as reasonably possible, to the Regulator and data subjects	Within 72 hours to the ODPC; data subjects within a reasonably practical period	Within 72 hours to the NDPC; data subjects immediately where high risk	Immediately, to the PDPO	Promptly, to the PDPC	Within 48 hours to the NCSA	Within 24 hours to the Commissioner; data subjects as soon as practicable	Within 72 hours to MACRA
Penalties	Administrative fines up to ZAR 10 million; up to 10 years' imprisonment for listed offences	Up to KES 5 million or 1% of annual turnover, whichever is lower; offences: up to KES 3 million and/or 10 years	Major importance: greater of NGN 10 million or 2% of annual gross revenue; others: greater of NGN 2 million or 2%	Up to about UGX 4.8 million and/or 10 years for listed offences	Penalty notices up to TZS 100 million; companies up to TZS 5 billion; individuals up to TZS 20 million and/or 10 years	Administrative fines of RWF 2 to 5 million or 1% of global turnover; corporate criminal fines of 5% of annual turnover	Corporate bodies: greater of 100 million penalty units or 2% of annual turnover; individuals up to 1 million penalty units and/or 5 years	Administrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to 5 years
	Open briefing →	Open briefing →	Open briefing →	Open briefing →		Open briefing →	Open briefing →	Open briefing →

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Reviewed October 2026 against: Personal Data Protection Act, 2022 (sections 27, 47 and 60) and the Personal Data Protection (Collection and Processing) Regulations, 2023.

Additional resources

Read the source documents.

Personal Data Protection CommissionRegulator website Personal Data Protection Act 2022Legislation

Supported through

Kenya Hub

East, Central & Southern Africa

DPO360 in Tanzania

How we support organisations in Tanzania.

Tanzania is supported through our Kenya hub, which covers East, Central & Southern Africa, with delivery coordinated from our Nairobi headquarters.

Registration and licensing filings with the national authority
Breach logging, escalation and regulator notification
Consent, policy and records-of-processing frameworks
Data mapping, including where data is processed
Data subject access request management
A standing DPO appointment, with DPO-as-a-Service

2nd Floor 90 JGO, James Gichuru Road, Lavington

P.O Box 40583-00100 Nairobi, Kenya

+254735360360 | +447394407463

Ready to Make Privacy Your Advantage?

Speak to our team about compliance in Tanzania and beyond.

Book a consultation DPO-as-a-Service

Data protection in Tanzania.

Tanzania, in seven lines.

What the law asks of you.

Register with the PDPC

Appoint a Data Protection Officer

Notify every breach promptly

Transfers abroad

From the law to the regulator.

The Act comes into force

The PDPC is fully operational

Enforcement begins

Personal Data Protection Commission (PDPC)

Registers collectors and processors

Handles complaints

Enforces the Act

What non-compliance can cost.

Where do you stand?

Eight countries at a glance.

Read the source documents.

How we support organisations in Tanzania.

Ready to Make Privacy Your Advantage?