Personal Data Protection Act, 2022
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 May 2023.
A comprehensive regime rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Process personal data lawfully, fairly and transparently, and only for an explicit and legitimate purpose.
- Register with the Personal Data Protection Commission before collecting or processing personal data.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Personal Data Protection Act, 2022 establishes the Personal Data Protection Commission and requires every data controller or processor to process personal data lawfully, fairly and transparently, collected for explicit, specified and legitimate purposes.
A person may not collect or process personal data without first registering as a data controller or data processor with the Commission, and public institutions that collect or process personal data are deemed registered from the Act's commencement. The Act applies to Mainland Tanzania and to Tanzania Zanzibar, except that in Zanzibar it does not reach non-union matters.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach