Tanzania

Personal Data Protection Act, Chapter 44 (Act No. 11 of 2022), section 24(1)(b) and (c): the Act reaches processing by a controller domiciled in the United Republic, and processing by a controller or processor NOT domiciled in the United Republic 'if the processing of the personal data is in United Republic and such processing is not for the purposes of mere transit of personal data through Tanzania to another country'. This is a location-of-processing test, not the targeting test used in the European Union or India, so a pure offshore software-as-a-service provider with no local processing has a genuine argument that it falls outside. In practice the argument is academic for anyone with staff, agents or infrastructure in-country, because section 14 bars any collection or processing without registration. The definitions of 'data controller' and 'data processor' in the 2023 Regulations each end with the words 'and it includes his representative', which pulls a local agent into the same duties. Note the practical gate: the regulator's registration process requires a Business Registrations and Licensing Agency certificate, a Tanzanian Taxpayer Identification Number certificate and audited accounts, so registering without a Tanzanian legal entity is difficult. The Act applies to Mainland Tanzania and to Zanzibar, but in Zanzibar only for union matters.

General rule: Personal Data Protection Act sections 31 and 32 allow transfer to a country with adequate protection, and to a country without it only where the recipient country's protection is assessed as adequate, or one of the narrow exceptions applies (the person consented, the transfer is needed for a contract, for legal claims, on public interest grounds, or to protect the person's own interests), or the Commission is satisfied that contractual and security safeguards make up the difference. Section 31(1) also lets the Commission simply prohibit transfer of personal data to a place outside the country. The 2023 Regulations turn this into a per-transfer licence: regulation 20 requires a written application on Form No. 7 before any transfer, the Commission has 14 days to decide, and an approved transfer is documented on a permit (Form No. 8). Regulation 22 fixes the conditions: named recipient only, stated purpose only, no onward transfer without further approval. Regulation 21 lets the Commission refuse where the transfer endangers national security or another written law restricts it. SECTOR OVERRIDES: - Banking (a copy must stay in the country, in practice a hard wall for the primary site): the Bank of Tanzania's Outsourcing Guidelines 2021 list 'primary data centre outside the country' among the things a bank or financial institution may not outsource. - Payments and electronic money (a copy must stay in the country): Payment Systems (Licensing and Approval) Regulations 2015, regulation 42 — a payment system provider shall place its primary data centre for payment system services in Tanzania. - Online gambling (a copy must stay in the country): Gaming (Internet Gaming) Regulations 2022, regulation 9 — the licensee's primary server must be in Mainland Tanzania; if the Board temporarily allows it abroad, a replica server must be physically in Mainland Tanzania and the financial control system must stay in Mainland Tanzania. - Government and public bodies (data must stay in the country in practice): e-Government Act 2019 sections 25 and 45 — public institutions must host systems in the Government approved hosting environment and use government processing and hosting facilities or a government-approved supplier environment only. - Telecommunications (data can leave with paperwork plus a licensing layer): mobile operators' subscriber registration systems must be permanently connected to the national identity authority, the immigration department and the regulator's central subscriber database, which in practice pins the registration system to Tanzania. Anyone selling data centre space to the public needs a network facility licence from the communications regulator. - Insurance and securities: no localisation or storage rule found on the insurance or capital markets regulators' own sites, checked 18 August 2026. The general permit rule still applies. - Health, education, mapping and defence: no sector-specific data storage rule found on the relevant ministries' own sites, checked 18 August 2026. Confidence medium — absence of a published rule is not proof there is none.

Model: approval each time. There is no populated allowlist and no published adequacy decision for any country as at 18 August 2026 — the Commission assesses adequacy inside each application instead, using the factors in section 32(2) of the Act (nature of the data, purpose and duration, the recipient's country, the laws in force there, and the professional rules and security measures applied there). Practical mechanics under regulation 20 of the 2023 Regulations: application on Form No. 7; the applicant must also produce proof that the destination country has ratified an international data protection agreement, or that Tanzania has an agreement with that country, or that there is a contract between the sender and the overseas recipient. Decision within 14 days; approval issued on Form No. 8; onward transfer to a further recipient needs fresh approval. The statutory exceptions in section 32(4) — consent, contract necessity, legal claims, public interest, protecting the person's interests — exist in the Act, but the Regulations impose the permit procedure without carving those cases out, so relying on an exception alone and skipping the permit is a live risk rather than a settled route. The Commission reported roughly 39 transfer permits issued as at May 2026, which is a small number relative to about 14,400 registered organisations: most cross-border processing in Tanzania is therefore probably unpermitted.

Personal Data Protection Commission: established by section 6 of the Act, sits under the Ministry of Communication and Information Technology, offices at 1 Moshi Street, Viwandani, Dodoma. Director General Dr. Emmanuel Lameck Mkilia. The board is constituted with a chairman, vice-chairman and five members named on the Commission's own site. Observable activity in the last twelve months: a first national data privacy conference held in Dar es Salaam from 29 June to 1 July 2026, a data protection officer training programme run with the Open University of Tanzania, and a certified-officer scheme announced. Why the rating is 'waking' and not 'active': the Act commenced on 1 May 2023; the Commission's own public notice of 10 January 2025 said voluntary registration ended on 31 December 2024, gave a final registration deadline of 30 April 2025, and said that from 1 May 2025 the Commission, working with law enforcement, would begin taking legal action against non-compliant institutions. So the enforcement phase formally began over a year ago and the registration volume shows real engagement. But the Commission's 'Determinations' page carried no published decisions when checked on 18 August 2026, and we found no published monetary penalty against any named organisation. A regulator that processes registrations and complaints but publishes no penalties is waking, not active. Sector regulators with their own powers over data: Bank of Tanzania (banking, payments, electronic money — licence conditions and revocation), Tanzania Communications Regulatory Authority (telecoms, online content, public data centres, cybersecurity service licences), Gaming Board of Tanzania (internet gaming servers), e-Government Authority (public sector systems and hosting). Police also hold direct powers over data under the Cybercrimes Act 2015.

FLOOR (minimum keeping periods, verified): - Anti-Money Laundering Regulations 2012, regulation 30: a reporting person shall retain records required by section 16 of the Anti-Money Laundering Act for a minimum of ten years. Insurers are separately directed to ten years after termination of a business relationship and ten years after completion of a transaction. - Payment Systems (Licensing and Approval) Regulations 2015, regulation 41: payment system providers keep records of all transactions for not less than ten years from the date of the transaction. - Telecommunications: under the 2025 subscriber registration rules an operator must keep the information gathered on a line replacement in an easily accessible database for twelve months. CEILING (when you must stop keeping it): - Personal Data Protection Act section 28: personal data is retained for the period specified in the relevant laws or prescribed in regulations, so that the person has a reasonable opportunity to access it; the Minister may prescribe retention and disposal rules matching the purpose. - 2023 Regulations, regulation 23: personal data must be stored in a form which permits identification of people only as long as necessary, and must not be transferred abroad contrary to the Act. CONFLICT RULE: there is no general override clause. In practice the sector minimum is a statutory obligation the privacy law expressly defers to (section 28 points outward to 'the relevant laws'), so the ten-year finance clocks beat any argument for early deletion, and a deletion request from an individual does not shorten them. We did not find a published Tanzania Revenue Authority record-keeping period on the revenue authority's own site during this run.

CLOCK 1 — privacy regulator: Personal Data Protection Act section 27(5): 'The data controller shall notify the Commission, without any undue delay, of any security breach affecting personal data being processed by or on behalf of the data controller.' No hour figure appears in the Act or in the 2023 Regulations. There is no statutory duty to notify affected individuals — a real gap compared with most modern regimes, and one that does not remove the reputational and contractual pressure to tell them anyway. CLOCK 2 — criminal investigation: Cybercrimes Act 2015 section 33 lets a police officer in charge of a station order the person in control of a device or data to preserve it for up to fourteen days, extendable by a court. Section 32(1) lets that same officer order disclosure of data without going to court first. CLOCK 3 — communications sector: licensed operators and cybersecurity service providers deal with the national computer emergency response team under the Electronic and Postal Communications (Computer Emergency Response Team) Regulations 2018, amended by GN No. 56 of 31 January 2025. The amendment requires a licence for anyone providing cybersecurity services and gives a fourteen-day window to notify the Authority of changes. We could not retrieve the principal 2018 regulations from the Authority's own site during this run, so the incident-reporting deadline inside them is unverified. OVERLAP RISK: an incident at a licensed bank or payment provider can trigger the privacy notification, a supervisory notification to the central bank and a communications-sector report at the same time, on three different clocks, with the shortest one unwritten.

TRAP 1 — the criminal fine dwarfs the administrative one. The Commission's maximum penalty notice is one hundred million Tanzanian shillings, roughly thirty-seven thousand United States dollars. But unlawfully disclosing, transmitting or selling personal data is a criminal offence: a company faces a fine of up to five billion shillings, roughly one point nine million dollars, and an individual up to ten years in prison. Under section 62 the company AND every officer who knowingly authorised or permitted the contravention are liable. The real exposure is criminal, not regulatory. TRAP 2 — a data protection officer for everyone, reporting quarterly to the state. Section 27(3) of the Act requires every controller and every processor to appoint one, with no size threshold. Regulation 32(c) of the 2023 Regulations then requires that officer 'to prepare and submit quarterly reports on the compliance of the Act to the Commission'. Four filings a year, from every registered organisation, is unusual and easy to miss. TRAP 3 — registration is a hard gate and a local-entity gate. Section 14: a person shall not collect or process personal data without being registered. Registration lasts five years, renewal must be applied for at least three months before expiry or you start again, and fees run from one hundred thousand shillings for a small organisation to one million shillings for a large one, roughly thirty-seven to three hundred and seventy dollars. The documents demanded — company registration certificate, taxpayer identification number, audited accounts — assume a Tanzanian entity. TRAP 4 — the code of ethics. Section 65: every data controller must draw up a code of ethics or policy for personal data protection and submit it to the Commission for consideration and approval. This is an approval, not a filing, and it is not satisfied by an off-the-shelf global privacy policy. TRAP 5 — sensitive data needs prior WRITTEN consent, and children's data is automatically sensitive. Section 30(1) forbids processing sensitive personal data without prior written consent, and the definition of sensitive personal data expressly includes data related to children as well as genetic data. Consent captured by a tick box is not written consent on any conservative reading. TRAP 6 — police access without a judge. Cybercrimes Act section 32(1): a police officer in charge of a station may order any person in possession of data to disclose it, for a criminal investigation, with court involvement only as a fallback if that order does not work. TRAP 7 — if you sell hosting, you must hand over your customer list. Anyone providing public data centre services needs a network facility licence from the communications regulator and must submit a list of all hosted customers to it every quarter.

ALREADY LANDED, STILL BEDDING IN: - Electronic and Postal Communications (Online Content) (Amendment) Regulations 2026, GN No. 158i, published 30 June 2026 and in operation from 1 July 2026: adds an 'Online Media Service Category C' covering amateur online media and rewrites the licence application route through the Authority's licensing portal. Anyone publishing news or current affairs online for a Tanzanian audience should re-check whether they now need a licence. - Public data centre licensing and the quarterly hosted-customer list, in force since 21 March 2025 (GN No. 157 of 2025). DORMANT SWITCHES — powers already held, usable with no consultation: 1. Section 32(3) of the Personal Data Protection Act: the Minister, after consulting the Commission, may by regulations specify categories of processing and circumstances in which transfer of personal data outside the United Republic is not authorised. That is an open-ended power to create hard localisation for named data types. Not used as at 18 August 2026. 2. Section 31(1): the Commission may prohibit the transfer of personal data to a place outside the country. A single destination could be closed off overnight. 3. Regulation 21(a) of the 2023 Regulations: a permit may be refused because the transfer endangers national security. There is no published test for this and no published appeal outcome. 4. Section 64(2)(a): the Minister may make regulations exempting things from the Act entirely — the switch also works in the permissive direction. 5. Section 18 of the Act and regulation 11: the Commission may deregister a controller or processor, which removes the right to process at all. WATCH ITEMS: the Commission signed a five-year agreement with the Open University of Tanzania to train and certify data protection officers, and its January 2025 public notice told organisations to work only with professionals recognised by the Commission — a certified-officer requirement could harden from guidance into a rule. No data protection amendment bill was visible on the ministry's own site when checked on 18 August 2026.