Personal Data Protection Act, 2022, application to processing of personal data
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 May 2023.
A personal data rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Register with the Personal Data Protection Commission and have a lawful basis before collecting or processing personal data through a crawler or data pipeline, whether or not the data was publicly accessible online.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Personal Data Protection Act, 2022 applies to any collection and processing of personal data performed wholly or partly by manual or automated means, by a controller domiciled in Tanzania or otherwise reached by the Act, with no carve-out for personal data that is otherwise publicly accessible.
Scraping personal data from a public Tanzanian website therefore remains subject to the Act's registration, lawful-basis, and cross-border-transfer duties, and biometric data is a sensitive personal data category carrying a heightened prior-written-consent requirement.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics