What Tanzania Personal Data Protection Act 2022 - PDPC requires
Tanzania's Personal Data Protection Act, 2022 (Act No. 11 of 2022) - assented to by President Samia Suluhu Hassan in 2022 and published in the Government Gazette of Tanzania - is Tanzania's first comprehensive personal data protection legislation, establishing a rights-based framework for the protection of personal data of natural persons in Tanzania. The supervisory authority is the Personal Data Protection Commission (PDPC), established under the Act as an independent public body responsible for registering data controllers and processors, receiving complaints, conducting investigations, and enforcing the Act. Tanzania's Personal Data Protection Act, 2022 reflects the broader East African data protection legislative movement and aligns with international data protection principles, drawing on the frameworks of Kenya's Data Protection Act 2019 and other East African Community (EAC) member states' legislative developments. Key features of Tanzania's Personal Data Protection Act, 2022: (1) Scope - applies to data controllers and data processors established in Tanzania or processing personal data of individuals in Tanzania regardless of where the controller or processor is located; (2) Data processing principles - processing must comply with: lawfulness; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability; (3) Sensitive personal data - the Act designates specific categories requiring enhanced protection: race or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; health data; sex life or sexual orientation; genetic data; biometric data used for unique identification; criminal convictions and offences; and financial data; (4) Lawful processing conditions - processing is permitted where: the data subject consents; the processing is necessary for a contract; required by legal obligation; necessary for vital interests; required for public interest; or justified by legitimate interests; (5) Data subject rights - right of access; right to rectification; right to erasure; right to restrict processing; right to data portability; right to object; and right not to be subject to automated decision-making with significant effects; (6) Data Protection Officer - required for controllers and processors conducting large-scale systematic monitoring, processing sensitive personal data on a large scale, or processing personal data of vulnerable groups; (7) Breach notification - controllers must notify the PDPC of personal data breaches within 72 hours of awareness; data subjects must be notified where the breach is likely to result in harm to their rights; (8) Cross-border transfers - personal data may only be transferred outside Tanzania to adequate jurisdictions or subject to PDPC-approved safeguards; (9) Registration - data controllers and processors must register with the PDPC before commencing processing; (10) Penalties - administrative fines imposed by the PDPC and criminal penalties including fines and imprisonment for serious violations. Tanzania's Personal Data Protection Act, 2022 positions Tanzania as a data-secure jurisdiction within the East African Community, supporting Tanzania's digital economy development objectives and regional data governance harmonisation.
Pillar: Data Protection & Privacy · Authority: Personal Data Protection Commission (PDPC, Tanzania) · Version: 1.0.0 · Last updated:
Primary source: https://www.pdpc.go.tz/
SHA-256 integrity: 72c4d4c7253da4a552fe2520167ac3129959976d9e14d34536af8f1563c7c61a
Primary Citations — 7 traced to source
- Personal Data Protection Act 2022 (Act No. 11 of 2022, Tanzania) - assented to by President Samia Suluhu Hassan in 2022; Tanzania's first comprehensive personal data protection legislation; seven processing principles: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability; sensitive personal data: race/ethnic origin, political opinions, religious beliefs, trade union membership, health, sex life, genetic, biometric, criminal convictions, financial data; data subject rights: access, rectification, erasure, restriction, portability, objection, automated decision-making protection; 72-hour PDPC breach notification; cross-border transfer restrictions; PDPC registration mandatory
- Personal Data Protection Commission (PDPC, Tanzania) - independent supervisory authority established under the Act; receives data controller and processor registrations; investigates complaints; conducts audits and inspections; issues enforcement orders; imposes administrative fines; approves cross-border transfers; publishes guidance on Act compliance including processing principles, sensitive data, DPO obligations, DPIA methodology, breach notification, and cross-border transfers at pdpc.go.tz
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/tz-pdpa-2022.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/tz-pdpa-2022.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/tz-pdpa-2022
- Back to registry: Browse all 10,099 compliance nodes