CevroTanzania: Personal Data Protection Act 2022 and what it requires
Personal Data Protection Act 2022: an established law with an active enforcement record. Overseen by Personal Data Protection Commission (Tanzania).
Key requirements at a glance
| Registration with the regulator | Required |
|---|---|
| Data protection officer | Required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Fines up to roughly TZS 100 million, plus institutional penalties.
What to know in practice
Mandatory registration for all controllers and processors; enforcement intensified through 2026.
How Cevro helps
- Maps Personal Data Protection Act 2022 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Tanzania?
Personal Data Protection Commission (Tanzania) oversees Personal Data Protection Act 2022.
Is breach notification mandatory under Personal Data Protection Act 2022?
Our reference does not record a fixed hourly deadline for Personal Data Protection Act 2022. Check the statute and Personal Data Protection Commission (Tanzania) guidance for the notification timing that applies to you.
Does Tanzania restrict cross-border data transfers?
Yes. Moving personal data out of Tanzania is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Personal Data Protection Act 2022?
Yes. Appointing a data protection officer is required.
What are the penalties for non-compliance in Tanzania?
Fines up to roughly TZS 100 million, plus institutional penalties.