Tanzania's Personal Data Protection Act, 2022: a compliance guide

The law and the regulator

Tanzania's Personal Data Protection Act, 2022 came into force on 1 May 2023. It established the Personal Data Protection Commission (PDPC), which registers data controllers and processors, receives complaints and enforces the Act. Regulations made in 2023 fill in the detail on collection, processing, transfers and complaints.

Registration

A data controller or data processor must be registered with the PDPC before collecting or processing personal data. Apply through the Commission's online registration system with a description of the processing, its purposes, the categories of data and data subjects, and your security measures. Keep the certificate and note its renewal date.

Core obligations

• Process personal data lawfully, fairly and for specified purposes
• Collect data directly from the data subject where possible, and tell them why
• Keep data accurate, and no longer than the purpose requires
• Protect data with appropriate security measures
• Answer data subject requests to access, correct or delete their data
• Transfer data outside Tanzania only where the Act's conditions for transfers are met

Breaches

A controller must take steps when personal data is compromised, including notifying the PDPC. Confirm the notification period in the current regulations with counsel; hlola uses 72 hours as its working default for Tanzanian entities until the period is confirmed. See Tanzania's PDPA in hlola.

Common questions