Personal Data Protection Act, 2022, investigation, enforcement and offences
Personal Data Protection Act 2022 (Act No. 11 of 2022), Part VII (ss. 39-50, investigation and enforcement) and Part IX (ss. 60-64, offences and general penalty)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 May 2023.
An enforcement supervision rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Expect the Personal Data Protection Commission to investigate a complaint and to be able to issue an enforcement notice or an administrative penalty of up to TZS 100,000,000.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unlawfully obtaining, disclosing or offering for sale personal data is an offence carrying, for an individual, a fine of not less than TZS 100,000 but not exceeding TZS 20,000,000 or imprisonment for a term not exceeding ten years, or both, and for a company or corporation a fine of not less than TZS 1,000,000 but not exceeding TZS 5,000,000,000 (s. 60); unlawfully destroying, deleting, misleading, concealing or altering personal data carries a fine of not less than TZS 100,000 but not exceeding TZS 10,000,000 or imprisonment for a term not exceeding five years, or both (s. 61); and any other contravention of the Act with no specifically stated penalty carries a general penalty of a fine of not less than TZS 100,000 but not exceeding TZS 5,000,000 or imprisonment for a term not exceeding five years, or both (s. 63).
Penalty structure
The Commission's administrative penalty for a contravention of the Act is capped at TZS 100,000,000 (s. 47); separate criminal fines and imprisonment terms attach to specific offences (see criminal_exposure_note).
- Rule
- Fixed only
- As of
- 6 September 2026
- Currency
- TZS
- Fixed cap
- 100,000,000
Who enforces it
Enforcement body
Personal Data Protection Commission
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A person may complain to the Commission of a violation of the personal-data-protection principles, and the Commission may investigate, issue an enforcement notice, and impose an administrative penalty of up to TZS 100,000,000 for a contravention of the Act. A person aggrieved by the Commission's decision may appeal to the High Court.
Separate criminal offences attach to specific conduct: unlawfully selling or disclosing personal data, and unlawfully destroying, deleting, concealing or altering personal data, each carrying its own fine and imprisonment range, and any other contravention with no specifically stated penalty carries a general penalty.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach