Law: The Personal Data Protection Act 2022, Act No. 11 of 2022 (PDPA)

Regulator: The Personal Data Protection Commission (PDPC)

Summary: The PDPA was passed into law on November 27, 2022, and contains detailed provisions imposing obligations on data controllers and data processors, including requirements associated with data security and international data transfers, and establishes the Personal Data Protection Committee (PDPC). The PDPA entered into force on May 1, 2023, by means of Government Notice No. 326 of 2023 (only available in Kiswahili here), which was published on April 28, 2023. Subsequently, on May 12, 2023, the Data Protection (Collection and Processing of Personal Data) Regulations, 2023 (only available in Kiswahili here) and the Data Protection (Complaints Handling Procedure) Regulations, 2023 (only available in Kiswahili here), were published by the Ministry of Information, Communication, and Information Technology.

Moreover, provisions regarding data protection can be found in various other pieces of legislation such as the Constitution of the United Republic of Tanzania (only available in Swahili here). In addition, the Cybercrimes Act, 2015 provides for offenses related to violations of privacy against or using a computer system located in Tanzania. There are also notable requirements in the financial sector through the Bank of Tanzania (Credit Reference Bureau) Regulations, 2012. Furthermore, the Electronic and Postal Communications Act, 2010 (EPOCA) governs electronic, telecommunications, and postal communications in Tanzania and is enforced by the Tanzania Communications and Regulatory Authority (TCRA).