The Personal Data Protection Commission (PDPC) of Tanzania has announced the enforcement of the Personal Data Protection Act (PDPA), Cap. 44 is now fully operational, with compliance inspections and enforcement actions already underway.
Key requirements from the PDPC notice dated 12 June 2026 are as follows:
- Organisations/entities/institutions that have not completed their registration as a Data Controller and/or Data Processor must do so within 7 working days.
- Organisations/entities/institutions that have not yet commenced registration must initiate and complete registration within 7 working days.
- All organisations/entities/institutions must be prepared for PDPC compliance inspections and audits, which have already commenced.
- Organisations/entities/institutions must have approved Personal Data Protection Policies and appropriate technical and organisational security measures in place.
- Organisations/entities/institutions collecting or processing personal data without registration as a Data Controller or Data Processor are now exposed to enforcement action, including fines, penalties, and administrative sanctions.
This notice signals a significant shift from voluntary compliance to active regulatory enforcement. The full notice can be accessed here.
The PDPC has emphasised and reiterated that collecting or processing personal data without the required registration and compliance measures constitutes a violation of the Act and may result in fines, penalties, administrative sanctions, and other enforcement actions.
In light of the commencement of enforcement activities and compliance inspections by the PDPC, organisations are encouraged to take immediate steps to:
- Verify their registration status.
- Ensure that their data protection policies, governance arrangements and security controls are fully compliant with the requirements of the Personal Data Protection Act and its regulations.
- Take immediate corrective action where necessary.
Please feel free to contact us should you require assistance with registration, compliance assessments, policy development, audit preparedness or regulatory engagement with the PDPC.
