Tanzania PDPA
Market regime · Personal Data Protection Act, 2022 (Tanzania)
United Republic of Tanzania
Tanzania
2022; commission operational, registration under way
Personal Data Protection Commission (PDPC)
You process personal data in Tanzania
Curated, versioned & cross-mapped
The obligation, plainly.
Tanzania's 2022 Act completed East Africa's data-protection map: a Personal Data Protection Commission, mandatory registration of controllers and processors, principles of lawful processing, data-subject rights and cross-border transfer conditions.
The regime is young and its regulations are still bedding in, which makes tracking it a versioning exercise: the catalog carries the Act's requirements and will absorb the commission's guidance as it hardens.
Where programmes are tested.
PDPC registration
Controllers and processors registered with the commission before processing.
Principles and rights
Lawful processing under the Act's principles, with rights honoured on statutory terms.
Transfers
Cross-border transfers on the Act's conditions, documented.
Curated once, evidenced continuously.
- The Act is curated beside its Kenyan and Ugandan neighbours and cross-mapped to the shared privacy control set: one East African privacy programme, three regulators answered.
- Requirements resolve to shared controls: implement a control once and it counts toward every framework it maps to.
- Status is evidence-gated: a requirement can't be marked implemented without valid, in-date evidence behind it.
- Every attestation carries maker/checker, and every action lands in an append-only audit trail.
Tanzania PDPA, asked plainly.
The questions compliance teams actually ask before an adoption decision or an audit.
Is registration mandatory in Tanzania?
Yes, the Act requires controllers and processors to register with the Personal Data Protection Commission, and operating unregistered exposes you from the first day of processing. Registration evidence belongs in the diligence pack alongside the Kenyan and Ugandan certificates.
How mature is enforcement?
The commission is new and building out its practice, which history says is a window, not a waiver: Kenya's ODPC moved from establishment to significant fines within a few years. Building to the Act now is cheaper than retrofitting under enforcement.
Can one programme cover Kenya, Uganda, Tanzania and Rwanda?
Substantively yes: the acts share the same principles-rights-registration shape, diverging in clocks and localisation details. The catalog curates each and cross-maps them to one control set, so the differences become checklist deltas rather than parallel programmes.
Where it connects.
The full catalogCompliance you can prove.
Walk into your next audit ready.
Book a working demo. We'll map your obligations to the standards you're audited against and the regulators you actually answer to.
The platform, modules, catalog, audit trail and security architecture are live today; the continuous live-evidence engine is in active development, shown in a working demo. Reach us at hello@cardinalgrc.com.