Tanzania

The Child Protection Laws (Miscellaneous Amendments) Act, 2024 repealed and replaced section 13 of the Cybercrimes Act, and amended section 3's definitions to add 'child sexual abuse material' or 'child sexual exploitation material', defined to mean any image, video, audio or written content depicting sexual acts involving a child or portraying a child in a sexualised manner, and to include any image, video or computer-generated material, whether created, adopted or modified, which cannot be differentiated from a real child.

As substituted, section 13 prohibits producing, offering, distributing, transmitting, procuring or knowingly possessing such material through a computer system, and prohibits compelling, inviting or allowing a child to view pornography or such material.

A person convicted is liable to a fine of not less than TZS 50,000,000 or three times the undue advantage received, whichever is greater, or imprisonment for a term of not less than seven years, or both, and may additionally be ordered to compensate the victim.

A data controller must protect personal data with security safeguards reasonable in the circumstances, and must notify the Personal Data Protection Commission without undue delay of any security breach affecting personal data being processed by or on behalf of the controller. The Act sets no fixed notification deadline and imposes no separate statutory duty on the controller to notify the affected data subject directly.

The Personal Data Protection Act, 2022 establishes the Personal Data Protection Commission and requires every data controller or processor to process personal data lawfully, fairly and transparently, collected for explicit, specified and legitimate purposes.

A person may not collect or process personal data without first registering as a data controller or data processor with the Commission, and public institutions that collect or process personal data are deemed registered from the Act's commencement. The Act applies to Mainland Tanzania and to Tanzania Zanzibar, except that in Zanzibar it does not reach non-union matters.

Personal data may be transferred to a country with an adequate personal-data-protection legal framework where the recipient establishes that the transfer is necessary and can subsequently verify that necessity, and the data controller ensures the recipient processes the data only for the purpose for which it was transferred.

A transfer to a country without such a framework is permitted only where an adequate level of protection is otherwise ensured and the data is transferred solely to permit authorised processing.

A data subject is entitled to be informed whether a controller is processing their personal data and to a description of that processing. Section 36 gives a data subject the right to require a controller to ensure that a decision significantly affecting them is not based solely on automated processing, subject to exceptions for contract performance, statutory authorisation or the subject's explicit consent, and lets the subject require the controller to reconsider the decision.

Section 37 entitles a data subject who suffers damage from any contravention of the Act to compensation from the controller or processor, and the Commission may separately order payment of compensation as part of its enforcement powers.

A person may complain to the Commission of a violation of the personal-data-protection principles, and the Commission may investigate, issue an enforcement notice, and impose an administrative penalty of up to TZS 100,000,000 for a contravention of the Act. A person aggrieved by the Commission's decision may appeal to the High Court.

Separate criminal offences attach to specific conduct: unlawfully selling or disclosing personal data, and unlawfully destroying, deleting, concealing or altering personal data, each carrying its own fine and imprisonment range, and any other contravention with no specifically stated penalty carries a general penalty.

Sensitive personal data, defined to include genetic data, data related to children, data related to offences, financial transactions, security measures and biometric data, may not be processed without the data subject's prior written consent, which may be withdrawn at any time without explanation or charge.

The Minister may by regulation determine circumstances in which the prohibition cannot be removed even with the data subject's consent, and where the data subject is a minor, a person of unsound mind, or another person unable to consent, consent must instead be sought from a parent, guardian or other legal representative.

Section 4 prohibits intentionally and unlawfully accessing or causing a computer system to be accessed, carrying a fine of not less than TZS 3,000,000 or three times the undue advantage received, or imprisonment of not less than one year, or both. Section 5 separately prohibits remaining in a computer system beyond authorised time. Section 6 prohibits illegal interception of non-public transmissions or electromagnetic emissions.

Section 7 prohibits illegal data interference, including damaging, deleting or altering computer data, carrying a fine of not less than TZS 10,000,000 or imprisonment of not less than three years, or both. Section 8 prohibits data espionage, obtaining computer data protected against unauthorised access, carrying imprisonment of not less than five years. Section 9 prohibits illegal system interference, hindering the functioning or usage of a computer system.

Unlike a statute that conditions the illegal-access offence on defeating a security measure, section 4's text requires only that the access be intentional and unlawful, without an express security-circumvention element, and no reported Tanzanian decision has addressed whether reading a public, unauthenticated page without authorisation from the site operator falls within the offence.

Tanzania has no sui generis database right. A compilation of data or a database is protected as a derivative literary or artistic work only where the selection or arrangement of its contents constitutes an intellectual creation, the same threshold the Act applies to encyclopaedias and anthologies, and that protection is without prejudice to any protection in the underlying, pre-existing data compiled.

The Personal Data Protection Act, 2022 applies to any collection and processing of personal data performed wholly or partly by manual or automated means, by a controller domiciled in Tanzania or otherwise reached by the Act, with no carve-out for personal data that is otherwise publicly accessible.

Scraping personal data from a public Tanzanian website therefore remains subject to the Act's registration, lawful-basis, and cross-border-transfer duties, and biometric data is a sensitive personal data category carrying a heightened prior-written-consent requirement.

Made by the Tanzania Communications Regulatory Authority under section 103 of the Electronic and Postal Communications Act (Cap. 306), these Regulations apply to online content service providers, internet service providers, application service licensees, online content users and other related online content.

Regulation 18 requires any person who provides, has access to, hosts, uses online content, or operates an internet cafe to take all possible measures to ensure that children do not register, access or contribute to prohibited content, and that users are provided with a content-filtering mechanism and parental control.

The Regulations carry a general penalty for any contravention for which no specific punishment is provided, and were published in the Gazette on 17 July 2020, revoking the prior 2018 online content Regulations.

Where an article on current economic, political or religious topics has been published in a newspaper or periodical, or broadcast or distributed by cable, the reproduction of that article in the press, or its communication to the public, is permitted free of the author's consent unless the original publication carried an express prohibition on such use, and provided the source is clearly indicated when the article is used in that manner.

Separately, for the purpose of reporting a current event by photography, cinematography or communication to the public, reproduction of a work that can be seen or heard in the course of that event is permitted to the extent justified by the informatory purpose. Neither exception is capped at a headline-length or short-extract threshold, and no reported Tanzanian decision has tested whether either reaches a systematic news aggregator's reproduction of headlines and snippets.