Data protection compliance in Tanzania
Tanzania's Personal Data Protection Act came into force in 2023. If you process personal data of people in Tanzania, we help you register and comply.
Key facts
- Main law
- Personal Data Protection Act, 2022, and its 2023 Regulations
- Regulator
- Personal Data Protection Commission (PDPC)
- Registration
- Data controllers and processors must register with the PDPC.
- Breach notification
- Report personal data breaches to the PDPC and take steps to limit harm to affected people.
- Penalties
- The PDPC can issue enforcement orders and administrative fines, and some breaches are criminal offences.
General information, last reviewed October 2026. Laws and regulator practice change, so confirm specifics with our team. This is not legal advice.
What you need to do
- Register with the PDPC as a data controller or processor
- Process personal data lawfully, fairly and for specific purposes
- Protect sensitive personal data with additional safeguards
- Respect data subject rights, including access, correction and objection
- Meet the conditions for transferring personal data outside Tanzania
- Keep personal data secure and report breaches
Compliance in Tanzania, handled
Registration
We prepare and submit your registration with the regulator.
Gap assessment
We review your product and operations against the law and give you a clear fix list.
Implementation
We fix the gaps in your policies, processes and code, including consent, audit logs and access control.
Outsourced DPO
We act as your Data Protection Officer on a monthly retainer.
Operating in more than one country? See our guides for Kenya, Uganda, Rwanda, or read our East Africa expansion checklist.
Ready to talk?
Book a free 30-minute consultation. Tell us what you're building and we'll tell you what to fix first.