Transfers of personal data outside Tanzania are only allowed where the recipient country:

• provides adequate protection (i.e., essentially equivalent to that within Tanzania) and the data is necessary for public interest tasks or the transfer does not prejudice the data subject’s interests; or
• provides appropriate safeguards, and data is transferred solely for authorized processing. 

Where the transfer is to a country which lacks adequate level of protection, (a) the transfer must be in accordance with the specific guidelines issued by the Minister responsible for Information, Communication and Information Technology, (b) the data subject must have consented to such transfer, and (c) the transfer must be necessary for:

• contractual, public interest or legal reasons, or for protection of the data subjects’ legitimate interests;
• compliance with law;
• a purpose relating to public information open for consultation. 

The data controller/processor must, prior to the transfer, carry out a provisional evaluation on the need to transfer such personal data, and must ensure the recipient of the data only processes the relevant information in the data and for the purpose for which the data was transferred. 

The recipient of the data must also ensure that the necessity for the transfer of the personal data can be subsequently verified. 

Prior to the transfer of personal data outside Tanzania, the data controller or processor must obtain a permit from the PDPC. The application must include proof of: 

• ratification of an international agreement on personal data protection by the recipient country;
• a bilateral agreement on personal data protection between Tanzania and the recipient country; or
• contractual safeguards with the recipient of the personal data outside Tanzania.