Tanzania PDPA 2022
The Personal Data Protection Act No. 11 of 2022
Key Facts
Overview
Tanzania's Personal Data Protection Act (PDPA) 2022 is the country's first comprehensive data protection legislation. Effective May 1, 2023, it established the Personal Data Protection Commission as the supervisory body. The law is notable for requiring mandatory DPO appointment for all controllers and processors, which is broader than most jurisdictions globally. Criminal penalties of up to 10 years imprisonment and administrative fines up to TZS 100 million apply for violations.
What This Means for Your Website
If your website collects personal data from Tanzanian users, you must process data lawfully with consent, appoint a Data Protection Officer, and conduct Data Protection Impact Assessments for high-risk processing. You need to ensure data is collected only for explicit, specified, and legitimate purposes, and you must have breach notification procedures in place.
Key Requirements
The PDPA requires all data controllers and processors to appoint a DPO. Personal data must be processed lawfully, fairly, and transparently. Data collection is limited to explicit, specified, and legitimate purposes. Breach notification to the Commission is mandatory. Data subjects have rights of access, correction, and deletion. DPIAs are required for high-risk processing activities.
How ConsentStack Handles This
ConsentStack provides a consent management platform that helps meet Tanzania's PDPA requirements. It delivers a compliant consent banner for lawful data collection, records all consent decisions with timestamps for audit purposes, and supports data subject rights workflows for access, correction, and deletion requests. ConsentStack's detailed logs help demonstrate compliance to the Personal Data Protection Commission.
Penalties
Administrative: up to TZS 100,000,000. Criminal: TZS 100,000-20,000,000 or up to 10 years imprisonment or both. Unlawful destruction/alteration: up to TZS 10,000,000 or 5 years imprisonment.
Key Requirements
- Personal data must be processed lawfully, fairly, and transparently
- Data collected for explicit, specified, and legitimate purposes only
- Mandatory DPO appointment for all controllers and processors
- Data breach notification requirements
- Data subjects have rights of access, correction, and deletion
- Data Protection Impact Assessments for high-risk processing
Notable Provisions
- Mandatory DPO appointment for ALL controllers and processors — broader than most jurisdictions
- Criminal penalties up to 10 years imprisonment
- Implementing regulations published shortly after the Act came into force
Other Sub-Saharan Africa Regulations
Frequently Asked Questions
Does Tanzania's PDPA require a Data Protection Officer?
Yes, the PDPA mandates DPO appointment for ALL data controllers and processors, which is broader than most data protection laws globally.
What are the penalties under Tanzania's PDPA?
Administrative fines up to TZS 100 million, criminal penalties ranging from TZS 100,000 to 20 million, and imprisonment of up to 10 years.
When did Tanzania's PDPA take effect?
The Act was enacted November 27, 2022, became effective May 1, 2023, with implementing regulations effective July 4, 2023.
Does Tanzania's PDPA apply to foreign companies?
The PDPA applies to all data controllers and processors operating within Tanzania, including foreign entities processing personal data in the country.
Stay compliant with Tanzania PDPA 2022
ConsentStack helps you implement Opt-in consent for United Republic of Tanzania automatically.