Tanzania · Compliance
Tanzania Personal Data Protection Act, 2022 compliance in Tanzania
Achieve Tanzania Personal Data Protection Act, 2022 compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Nairobi office team
- Effivity software included
- Academy training included
Who asks for Tanzania Personal Data Protection Act, 2022 in Tanzania
Clients include
Tanzania Personal Data Protection Act, 2022 compliance in Tanzania at a glance
Personal Data Protection Act, 2022 (Act No. 11 of 2022), Cap. 44 is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Tanzania ask for evidence that you meet it.
Registration comes first under Tanzania's Personal Data Protection Act, 2022: section 14 bars anyone from collecting or processing personal data until the Personal Data Protection Commission has registered them, and the PDPC runs the process online. The Act came into force on 1 May 2023 and reaches foreign controllers and processors whose processing happens in Tanzania. It asks for lawful, purpose-bound collection with notice, prior written consent for sensitive data, safeguards suited to the risk, a data protection officer, processor contracts and notification of breaches to the Commission. Data sent abroad needs adequate protection or a listed ground, and the PDPC issues transfer permits under the 2023 regulations. No certificate proves compliance, though ISO/IEC 27701 can support the evidence. Sterling's Nairobi office maps your data, sets owners for each duty and keeps the evidence current in Effivity, with Sterling Academy training for staff included.
Who needs Tanzania Personal Data Protection Act, 2022 in Tanzania, and what happens without it
These are the organisations in Tanzania that most often need to show Tanzania Personal Data Protection Act, 2022.
- Any organisation that collects or processes personal dataSection 14 bars collecting or processing personal data without registration with the Commission as a controller or processor.
- Foreign controllers and processors processing data in TanzaniaThe Act reaches processing in the United Republic by controllers or processors not domiciled there, unless the data is only in transit.
- Groups that send personal data abroadTransfers depend on adequate protection or listed grounds, and the PDPC issues permits for transfers outside the country.
- Banks, health providers and others handling sensitive dataSensitive personal data needs prior written consent unless a listed exception applies.
- Cloud, payroll and outsourcing providers acting as processorsProcessors work under a contract with the controller and share responsibility for the Act's security standards.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkTanzania Personal Data Protection Act, 2022 requirements in Tanzania
Strip away the vocabulary and Tanzania's Personal Data Protection Act requires a business to comply in six areas of personal data handling.
In Tanzania these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Tanzania Personal Data Protection Act, 2022 explained →
How to achieve Tanzania Personal Data Protection Act, 2022 compliance in Tanzania
One team from the Nairobi office carries the work from scoping to sign-off. Clients across Tanzania are served from Sterling's Nairobi office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Tanzania Personal Data Protection Act, 2022 and the Tanzanian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Tanzania Personal Data Protection Act, 2022 compliance take in Tanzania?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Tanzania these are the factors that set the timeline.
- Number of processing activities, systems and processors to map
- Registration status with the PDPC
- Transfers abroad that need a permit or safeguards
- Security remediation and breach procedure readiness
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Tanzania Personal Data Protection Act, 2022 compliance cost in Tanzania?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Tanzania these factors move both.
- Number of legal entities and business units in scope
- Volume and sensitivity of personal data
- Processor contract review and impact assessments
- Security control remediation
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Tanzania Personal Data Protection Act, 2022 consultants and assessors in Tanzania
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Tanzania Personal Data Protection Act, 2022 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Tanzania are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Tanzania Personal Data Protection Act, 2022 in Tanzania (4)
| Instrument | How it treats the standard |
|---|---|
| Personal Data Protection Act, 2022 (Act No. 11 of 2022), Cap. 44 | The instrument itself Registration with the PDPC, principles, collection and use limits, security and a data protection officer, breach notification, sensitive data, transfers abroad and data subject rights; in force from 1 May 2023 as printed in the Act and stated by the PDPC. |
| Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN. No. 449C) | Regulations Registration procedure, procedures for data subject rights, permission to transfer data out of the country, security standards, protection by design or by default, data protection officer duties and impact assessment. |
| Personal Data Protection (Complaints Settlement Procedures) Regulations, 2023 (GN. No. 449B) | Regulations How complaints are lodged with and settled by the Commission. |
| PDPC registration and cross-border transfer permit services | Regulator practice Online registration with supporting documents and a data protection officer introduced by letter; permits for transfers of personal data outside the country. |
Accreditation, audit language and remote audits in Tanzania
Compliance, not certification: the Personal Data Protection Act, 2022 has no certificate that proves compliance. Evidence is a PDPC registration certificate, records of what is collected and why, privacy notices, processor contracts, security measures, a data protection officer, impact assessments where the regulations call for them, transfer permits or safeguards and a working breach procedure. ISO/IEC 27701 certification by an accredited body is an optional way to evidence a privacy management system. Edition and transition details: Tanzania Personal Data Protection Act, 2022 hub →
Audit language
Privacy notices and consent requests should be in a language the people concerned understand, often Kiswahili and English; the Act is published with a Kiswahili text and an English version.
Remote and on-site
Data mapping and privacy workshops can run on-site or remotely; the Act prescribes no external assessment, while the Commission may investigate complaints and monitor compliance.
Tanzania Personal Data Protection Act, 2022 in Tanzania: questions clients ask
Must a business in Tanzania register with the PDPC?
Yes, before it collects or processes personal data. Section 14 of the Act bars processing without registration as a controller or processor, and public institutions are deemed registered. The PDPC runs registration online and asks private organisations for their BRELA certificate, TIN certificate and audited financial report. Check your own position with the Commission or your counsel.
Can personal data be sent outside Tanzania?
Yes, under conditions. The Act allows transfers where the destination gives adequate protection or a listed ground applies, such as consent or a contract with the person, and the Commission can authorise transfers backed by adequate safeguards. The PDPC issues permits for transfers out of the country under the 2023 regulations. Map your flows and confirm the route with the PDPC.
Is there a certificate that proves PDPA compliance?
No. Compliance shows in evidence: PDPC registration, records of processing, notices, processor contracts, security measures, a data protection officer, impact assessments where required, transfer permits and a breach procedure. ISO/IEC 27701 certification from an accredited body can support that evidence, but it is optional and never replaces the Act's duties. Ask your counsel how the Commission reviews evidence.
What must a controller do after a personal data breach?
Notify the Personal Data Protection Commission without undue delay. Section 27 of the Act requires the controller to report any security breach affecting personal data processed by it or on its behalf, alongside keeping safeguards suited to the risk. Prepare a tested breach procedure in advance, and confirm reporting detail with the Commission or your legal adviser.
More on Tanzania Personal Data Protection Act, 2022 for Tanzanian organisations
Other standards Tanzanian businesses ask Sterling for
Organisations in Tanzania often combine Tanzania Personal Data Protection Act, 2022 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Nairobi office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act, 2022 (Act No. 11 of 2022), Cap. 44 — pdpc.go.tz (accessed 12 Oct 2026)
- Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN. No. 449C) — pdpc.go.tz (accessed 12 Oct 2026)
- Personal Data Protection (Complaints Settlement Procedures) Regulations, 2023 (GN. No. 449B) — pdpc.go.tz (accessed 12 Oct 2026)
- PDPC registration and cross-border transfer permit services — pdpc.go.tz (accessed 12 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice