Data protection is primarily governed by the Personal Data Protection Act, 2022 (“PDPA”), which came into force on 1 May 2023. The PDPA regulates the collection, processing and protection of personal data by both public and private entities. 

The Act established core principles and minimum requirements for lawful data processing. Based on the principles for protection of personal data, provided under section 5, personal data must be: 

• processed lawfully, fairly, transparently and securely;
• collected for explicit, specific, legitimate purposes and not further processed contrary to those purposes;
• accurate and kept up to date;
• adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
• kept in a form which identifies the data subjects and retain for as long as necessary; and
• not be transferred outside Tanzania, except in compliance with the PDPA. 

The key components of the PDPA includes:

• Part II: establishes the Personal Data Protection Commission (“PDPC”)
• Part III: provides for registration of the personal data controllers and processors.
• Part IV: provides for data processing principles.
• Part V: provides for cross-border transfer of personal data
• Part VI: provides for data subjects rights 

The PDPA has two regulations, namely: 

• the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (“PDPA Processing Regulations”); and
• the Personal Data Protection (Complaints Settlement Procedures) Regulations, 2023, as amended (“PDPA Complaints Regulations”).

The PDPA and its Regulations operates together with other laws providing for data protection, including: 

• the Constitution of the United Republic of Tanzania, 1977 (“Constitution”); and
• other sector specific legislations, for instance the Electronic and Postal Communications Act, 2010 (“EPOCA”) and its regulations applicable to the electronic and postal communication sector and the National Payment System Act, 2015 (“NPS Act”) and the Bank of Tanzania (Financial Consumer Protection) Regulations, 2019 applicable to the financial services sector.