Tanzania. Comprehensive data protection. Act
PDPAPersonal Data Protection Act, 2022 (Act No. 11 of 2022)
In force
§1Summary
- Synopsis
Tanzania's first comprehensive data protection law, establishing the PDPC and principles, rights and controller/processor duties. Regulations made in 2023 set the registration and transfer-permit procedures.
- Key themes
- Unique features
All controllers and processors must register (certificate valid five years, fee by headcount) and appoint a DPO who files quarterly compliance reports. Each cross-border transfer needs a PDPC permit, with no onward transfer without approval.
- SaaS relevance
Any SaaS provider collecting or processing Tanzanian personal data must register and obtain transfer permits to move data offshore, which affects hosting outside Tanzania.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- PDPC promptly for any breach
- DPO
- Yes
- Cross-border transfers
- Adequacy/safeguards plus mandatory PDPC transfer permit
- Maximum penalty
- Administrative fine up to TZS 100m; corporate criminal fines up to TZS 5bn
§3Dates
- Key dates
- Adopted
- In force
- Collection and Processing Regulations and Complaints Handling Regulations effective 2023-05-12; PDPC fully operational 2024-04-03; registration deadline extended in 2024
§4Text and authority
- Text
- Authoritative text pdpc.go.tz
- Authority
- Personal Data Protection Commission (PDPC)
§5Where it applies
- Domestic law of
- Tanzania
§6Sources and verification
- Verification
High confidence.
PDPC URL not directly fetched.