Tanzania's Personal Data Protection Act, 2022 places clear duties on any business that collects or uses personal information. Here is a practical overview for companies.

Who is covered

The Act applies to data controllers and data processors, meaning any organisation that decides how or why personal data is processed, or handles it on behalf of another. Banks, telecoms, hospitals, schools, employers and online businesses are all affected.

Key principles

• Personal data must be collected for a lawful, specific purpose and processed fairly.
• Data should be accurate, limited to what is necessary and kept only as long as needed.
• Appropriate security measures must protect the data from loss, misuse or unauthorised access.
• Individuals have rights, including access to, and correction of, their personal data.

Registration and oversight

The Act established the Personal Data Protection Commission, which oversees compliance, and requires controllers and processors to register with it. Penalties apply for non-compliance.

Cross-border transfers

Transferring personal data outside Tanzania is restricted and generally requires adequate protection or other lawful grounds. Companies using foreign cloud services or sharing data with overseas affiliates should review their arrangements.

Steps to become compliant

Map the personal data you hold, update privacy notices and consent processes, adopt a data protection policy, sign data processing agreements with vendors and train staff. We can guide your business through each step.

This article is general information about Tanzanian law and is not legal advice. Laws and regulations change; speak to an advocate before acting on any matter.