Tanzania

The reach comes from the Personal Data Protection Act, Chapter 44 (Act No. 11 of 2022), section 24(1)(b) and (c). The Act covers a company that decides how data is used and is domiciled in the United Republic. It also covers a company that is not domiciled there, if the data is handled in the United Republic. It does not cover data that is merely passing through Tanzania on the way to another country. So the test is where the data is handled. It is not the targeting test used in the European Union or India. A pure offshore software-as-a-service provider that handles nothing locally has a real argument that it falls outside. That argument matters little for anyone with staff, agents or infrastructure in the country. Section 14 bars any collection or use of data without registration. The 2023 Regulations define the company that decides how data is used, and the company that handles data for it. Both definitions end with the words 'and it includes his representative'. That pulls a local agent into the same duties. There is also a practical gate. The regulator's registration process requires a Business Registrations and Licensing Agency certificate, a Tanzanian Taxpayer Identification Number certificate, and audited accounts. Registering without a Tanzanian legal entity is difficult. The Act applies to Mainland Tanzania and to Zanzibar. In Zanzibar it applies only to union matters.

General rule: sections 31 and 32 of the Personal Data Protection Act. You may send data to a country with adequate protection. You may send it to a country without adequate protection only in limited cases. Either the recipient country's protection is assessed as adequate. Or one of the narrow exceptions applies. The person consented. The transfer is needed for a contract, for legal claims, or on public interest grounds. Or it protects the person's own interests. Or the Commission is satisfied that contract terms and security measures make up the difference. Section 31(1) also lets the Commission simply ban transfers of personal data to a place outside the country. The 2023 Regulations turn this into a permit for each transfer. Regulation 20 requires a written application on Form No. 7 before any transfer. The Commission has 14 days to decide. An approved transfer is documented on a permit (Form No. 8). Regulation 22 sets the conditions: named recipient only, stated purpose only, and no onward transfer without further approval. Regulation 21 lets the Commission refuse where the transfer endangers national security, or where another written law restricts it. INDUSTRY RULES: - Banking (a copy must stay in the country, and a firm rule for the main site). The Bank of Tanzania's Outsourcing Guidelines 2021 name one thing a bank or financial institution may not outsource: a 'primary data centre outside the country'. - Payments and electronic money (a copy must stay in the country): Payment Systems (Licensing and Approval) Regulations 2015, regulation 42. A payment system provider must place its primary data centre for payment system services in Tanzania. - Online gambling (a copy must stay in the country): Gaming (Internet Gaming) Regulations 2022, regulation 9. The licensee's primary server must be in Mainland Tanzania. If the Board temporarily allows it abroad, a replica server must sit physically in Mainland Tanzania. The financial control system must stay in Mainland Tanzania. - Government and public bodies (data must stay in the country): e-Government Act 2019, sections 25 and 45. Public institutions must host systems in the Government approved hosting environment. They must use government facilities, or a government-approved supplier environment only. - Telecommunications (data can leave only if conditions are met, plus a licence layer). Mobile operators' subscriber registration systems must be permanently connected to three systems. Those are the national identity authority, the immigration department and the regulator's central subscriber database. That pins the registration system to Tanzania. Anyone selling data centre space to the public needs a network facility licence from the communications regulator. - Insurance and securities: we found no storage or location rule on the insurance or capital markets regulators' own sites, checked 18 August 2026. The general permit rule still applies. - Health, education, mapping and defence: we found no storage rule for these industries on the relevant ministries' own sites, checked 18 August 2026. Confidence medium. No published rule is not proof that none exists.

Model: approval each time There is no list of approved countries. As at 18 August 2026 there is no published official decision that any country is safe enough. The Commission judges that inside each application instead. It uses the factors in section 32(2) of the Act. Those are the nature of the data, and the purpose and duration. Also the recipient's country, the laws in force there, and the professional rules and security measures applied there. How it works under regulation 20 of the 2023 Regulations. You apply on Form No. 7. You must also produce one of three things. Proof that the destination country has ratified an international data protection agreement. Or proof that Tanzania has an agreement with that country. Or a contract between you and the overseas recipient. The decision comes within 14 days. Approval is issued on Form No. 8. Passing the data on to a further recipient needs fresh approval. The Act's exceptions sit in section 32(4). They are consent, contract necessity, legal claims, public interest, and protecting the person's interests. The Regulations impose the permit procedure without excluding those cases. So relying on an exception and skipping the permit is a live risk, not a settled route. The Commission reported roughly 39 transfer permits issued as at May 2026. That is small against about 14,400 registered organisations. Most data leaving Tanzania is therefore probably unpermitted.

Personal Data Protection Commission: created by section 6 of the Act. It sits under the Ministry of Communication and Information Technology. Its offices are at 1 Moshi Street, Viwandani, Dodoma. The Director General is Dr. Emmanuel Lameck Mkilia. The board has a chairman, a vice-chairman and five members, all named on the Commission's own site. In the last twelve months it held a first national data privacy conference in Dar es Salaam, from 29 June to 1 July 2026. It also ran a data protection officer training programme with the Open University of Tanzania, and announced a certified-officer scheme. Why we rate it 'waking' and not 'active'. The Act started on 1 May 2023. The Commission's own public notice of 10 January 2025 said voluntary registration ended on 31 December 2024. It gave a final registration deadline of 30 April 2025. It said that from 1 May 2025 the Commission would work with law enforcement to take legal action against organisations that had not complied. So enforcement formally began over a year ago, and the registration numbers show real engagement. But the Commission's 'Determinations' page carried no published decisions when we checked on 18 August 2026. We found no published fine against any named organisation. A regulator that handles registrations and complaints but publishes no penalties is waking, not active. Other regulators have their own powers over data. The Bank of Tanzania covers banking, payments and electronic money, through licence conditions and revocation. The Tanzania Communications Regulatory Authority covers telecoms, online content, public data centres and cybersecurity service licences. The Gaming Board of Tanzania covers internet gaming servers. The e-Government Authority covers public sector systems and hosting. Police also hold direct powers over data under the Cybercrimes Act 2015.

MINIMUM KEEP TIMES (verified): - Anti-Money Laundering Regulations 2012, regulation 30. A reporting person must keep the records required by section 16 of the Anti-Money Laundering Act for at least ten years. Insurers are separately directed to keep records for ten years after a business relationship ends, and ten years after a transaction is completed. - Payment Systems (Licensing and Approval) Regulations 2015, regulation 41. Payment system providers keep records of all transactions for not less than ten years from the transaction date. - Telecommunications: the 2025 subscriber registration rules cover line replacements. An operator must keep the information gathered in an easily accessible database for twelve months. WHEN YOU MUST STOP KEEPING IT: - Personal Data Protection Act, section 28. Personal data is kept for the period set in the relevant laws or in regulations. The point is to give the person a reasonable chance to see it. The Minister may set rules on keeping and disposing of data to match the purpose. - 2023 Regulations, regulation 23: personal data must be stored in a form that identifies people only as long as necessary. It must not be sent abroad in breach of the Act. WHICH ONE WINS: there is no general override clause. The industry minimum is a duty set by statute, and section 28 of the privacy law points outward to 'the relevant laws'. So the ten-year finance periods beat any argument for early deletion. A deletion request from an individual does not shorten them. We did not find a published Tanzania Revenue Authority record-keeping period on the revenue authority's own site.

DEADLINE 1: the privacy regulator. Section 27(5) of the Personal Data Protection Act says you must tell the Commission about any security breach affecting personal data you hold. It covers data someone else holds on your behalf too. You must do it without any undue delay. No hour figure appears in the Act or in the 2023 Regulations. There is no legal duty to tell the people affected. That is a real gap compared with most modern privacy laws. It does not remove the reputational and contractual pressure to tell them anyway. DEADLINE 2: criminal investigation. Section 33 of the Cybercrimes Act 2015 gives a police officer in charge of a station a power. They can order whoever controls a device or data to preserve it for up to fourteen days. A court can extend that. Section 32(1) lets the same officer order disclosure of data without going to court first. DEADLINE 3: the communications industry. Licensed operators and cybersecurity service providers deal with the national computer emergency response team. The rules are the Electronic and Postal Communications (Computer Emergency Response Team) Regulations 2018, amended by GN No. 56 of 31 January 2025. The amendment requires a licence for anyone providing cybersecurity services. It also gives a fourteen-day window to tell the Authority about changes. We could not retrieve the main 2018 regulations from the Authority's own site, so the reporting deadline inside them is unverified. OVERLAP RISK: one incident at a licensed bank or payment provider can trigger three reports at once. The privacy notification, a supervisory notification to the central bank, and a communications-industry report. Three different deadlines, and the shortest one is not written down.

TRAP 1: the criminal fine is far bigger than the regulator's fine. The Commission's maximum penalty notice is one hundred million Tanzanian shillings, roughly thirty-seven thousand United States dollars. But unlawfully disclosing, transmitting or selling personal data is a crime. A company faces a fine of up to five billion shillings, roughly one point nine million dollars. An individual faces up to ten years in prison. Under section 62 the company and every officer who knowingly authorised or permitted the breach are liable. The real exposure is criminal, not regulatory. TRAP 2: everyone needs a data protection officer, reporting to the state every quarter. Section 27(3) of the Act requires an appointment from every company that decides how data is used, and every company that handles data for them. There is no size cut-off. Regulation 32(c) of the 2023 Regulations then makes that officer 'prepare and submit quarterly reports on the compliance of the Act to the Commission'. Four filings a year, from every registered organisation, is unusual and easy to miss. TRAP 3: registration is a firm gate, and it assumes a local entity. Section 14 says a person shall not collect or use personal data without being registered. Registration lasts five years. You must apply to renew at least three months before it expires, or you start again. Fees run from one hundred thousand shillings for a small organisation to one million shillings for a large one. That is roughly thirty-seven to three hundred and seventy dollars. The documents demanded assume a Tanzanian entity: company registration certificate, taxpayer identification number and audited accounts. TRAP 4: the code of ethics. Section 65 says every company that decides how data is used must draw up a code of ethics or policy for personal data protection. You then submit it to the Commission for consideration and approval. This is an approval, not a filing. An off-the-shelf global privacy policy will not do. TRAP 5: sensitive data needs written consent in advance, and children's data counts as sensitive. Section 30(1) forbids the use of sensitive personal data without prior written consent. The definition of sensitive personal data expressly includes data related to children, as well as genetic data. A tick box is not written consent on any careful reading. TRAP 6: police access without a judge. Section 32(1) of the Cybercrimes Act covers criminal investigations. A police officer in charge of a station may order any person holding data to disclose it. A court is involved only as a fallback, if that order does not work. TRAP 7: if you sell hosting, you must hand over your customer list. Anyone providing public data centre services needs a network facility licence from the communications regulator. They must also give it a list of all hosted customers every quarter.

ALREADY LANDED, STILL BEDDING IN: - Electronic and Postal Communications (Online Content) (Amendment) Regulations 2026, GN No. 158i. Published 30 June 2026, in operation from 1 July 2026. It adds an 'Online Media Service Category C' covering amateur online media. It also rewrites the licence application route through the Authority's licensing portal. If you publish news or current affairs online for a Tanzanian audience, check whether you now need a licence. - Public data centre licensing and the quarterly hosted-customer list, in force since 21 March 2025 (GN No. 157 of 2025). POWERS ALREADY HELD, USABLE WITH NO CONSULTATION: 1. Section 32(3) of the Personal Data Protection Act. The Minister may make regulations after consulting the Commission. They can name types of data handling, and situations, where sending personal data outside the United Republic is not allowed. That is an open-ended power to force named types of data to stay in the country. Not used as at 18 August 2026. 2. Section 31(1). The Commission may ban the transfer of personal data to a place outside the country. A single destination could be closed off overnight. 3. Regulation 21(a) of the 2023 Regulations. A permit may be refused because the transfer endangers national security. There is no published test for this and no published appeal outcome. 4. Section 64(2)(a). The Minister may make regulations exempting things from the Act entirely. The power works in the permissive direction too. 5. Section 18 of the Act and regulation 11. The Commission may deregister an organisation, which removes its right to use data at all. WATCH ITEMS: the Commission signed a five-year agreement with the Open University of Tanzania to train and certify data protection officers. Its January 2025 public notice told organisations to work only with professionals recognised by the Commission. A certified-officer requirement could harden from guidance into a rule. No data protection amendment bill was visible on the ministry's own site when we checked on 18 August 2026.