Tanzania PDPA compliance and requirements, so your data handling holds up when someone asks.

What it is

What is Tanzania's Personal Data Protection Act and what is it used for?

The Personal Data Protection Act, 2022 (Act No. 11 of 2022, Chapter 44 of the Laws of Tanzania) is Tanzania's general law on personal data, in force from 1 May 2023. It applies in Mainland Tanzania and in Tanzania Zanzibar except non-union matters, to manual and automated processing. Section 14 bars anyone from collecting or processing personal data without registering with the Commission as a controller or processor; public institutions are deemed registered. The Act sets lawful, purpose-bound collection with notice, prior written consent for sensitive data, safeguards suited to the risk, a data protection officer, processor contracts, breach reporting, rights of access, correction and objection, and conditions for transfers abroad.

The Personal Data Protection Commission, established under section 6, runs registration online, issues permits for transfers out of the country and settles complaints. The Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 set the procedures for registration, rights, transfer applications, security standards, protection by design or by default, the officer's duties and impact assessment. The practical test: for any personal data you hold, could you show your registration, its purpose, who was told, how it is protected and where it goes?

Current law. The Personal Data Protection Act, 2022 came into force on 1 May 2023 (GN. No. 326 of 2023), with the English version published as GN. No. 395B of 2023. The Collection and Processing Regulations (GN. No. 449C of 2023) and the Complaints Settlement Procedures Regulations (GN. No. 449B of 2023) apply alongside it. Confirm current wording and the Commission's guidance with your legal advisers.

Who it is for

Who needs to comply with the Tanzania Personal Data Protection Act?

The Act applies to controllers domiciled in Tanzania, whatever their size, and to controllers and processors outside it whose processing takes place in Tanzania. Organisations usually come to Sterling for a structured programme from one of four directions:

• You must register before you process. Section 14 bars collecting or processing personal data without registration with the Commission as a controller or processor. The PDPC runs registration online and asks private organisations for their BRELA certificate, TIN certificate and audited financial report.
• You handle sensitive personal data. Banks, health providers and others holding sensitive data need the person's prior written consent, which can be withdrawn at any time, unless a listed exception applies.
• You process data for others. Cloud, payroll and outsourcing providers act under a contract with the controller and share responsibility for the Act's security standards, so clients ask for that evidence first.
• You send personal data abroad. Transfers depend on adequate protection in the destination or a listed ground, and the PDPC issues permits for transfers outside the country under the 2023 regulations.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Tanzania PDPA requirements?

Strip away the vocabulary and Tanzania's Personal Data Protection Act requires a business to comply in six areas of personal data handling. The list below puts each one in business terms; the Act and the regulator's guidance give the full wording and exceptions.

• Register with the Commission before processing: controllers and processors register with the Personal Data Protection Commission before collecting or processing personal data, renew on time and keep registered details current.
• Collect lawfully, openly and for set purposes: data is collected for a lawful purpose, directly where possible, with people told why and who receives it, and later uses stay within permitted purposes.
• Get written consent for sensitive data: sensitive personal data is processed only with the person's prior written consent, which can be withdrawn at any time, unless a listed exception applies.
• Secure data with an accountable officer: safeguards fit the risk and the data, a data protection officer oversees controls, and processors act only under a contract with the controller.
• Report breaches to the Commission promptly: any security breach affecting personal data processed by or for the controller goes to the Commission without undue delay.
• Respect rights and safeguard transfers abroad: people can access, correct and object to processing, including direct marketing and solely automated decisions; data leaves Tanzania only with adequate protection, a listed ground or Commission authorisation.

Compliance route

How do you achieve Tanzania PDPA compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the Personal Data Protection Commission if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, staff, patients, users and suppliers: what is collected, for which purpose, on which basis, where it is stored, who processes it for you, whether your registration covers it and whether it leaves Tanzania.
2. 02
   Gap analysis: compare current practice with the Act.Each area of the Act reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Complete or renew the registration, rewrite notices and consent wording, put security measures and processor contracts in place, appoint the data protection officer, prepare impact assessments where required and agree a breach procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests, record incidents and report them to the Commission, keep the registration current, review transfers and permits, refresh training and follow the Commission's guidance as it is issued.

Check the route before you sign. The Act creates no certificate of compliance, so treat any offer of a "PDPA certificate" with suspicion; the registration certificate the PDPC issues records registration, not compliance. If a customer wants independent assurance, ISO/IEC 27701 or ISO/IEC 27001 is certifiable by an accredited certification body; confirm the body's accreditation scope directly with the accreditation body concerned.

Cost

How much does Tanzania PDPA compliance cost?

The cost of a Tanzania PDPA programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Tanzania PDPA compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Tanzania PDPA engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Act, and the Act creates no certificate of compliance; the Personal Data Protection Commission supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, consent wording, request, security, impact assessment and breach procedures, processor contract terms and transfer documents, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Registration and officer support

  Help preparing the registration with the Commission and the data protection officer's introduction, with findings closed with evidence.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Personal Data Protection Commission, established under section 6 of the Act, registers controllers and processors, issues transfer permits and settles complaints.

Often combined with

Standards organisations pair with PDPA (Tanzania)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.