The decision in brief

Three Tanzanian regimes shape what "compliant" means for most organisations: the Personal Data Protection Act, 2022 (PDPA), the Cybercrimes Act, 2015, and, if you handle money, sector rules from the Bank of Tanzania (BoT) and, for SACCOS, the Tanzania Cooperative Development Commission (TCDC). Start with data protection. It applies to almost every organisation that holds customer, member, donor, patient or staff data, and it requires registration.

1. Personal Data Protection Act, 2022

The PDPA came into force on 1 May 2023 and created the Personal Data Protection Commission (PDPC). Key points for decision-makers:

  • Registration. Data controllers and data processors must register with the PDPC before collecting or processing personal data. The registration deadline was extended more than once; the most recent extension reported by law firms was 30 April 2025. Confirm the current position with the PDPC.

  • Core principles. Collect only the data you need, use it for the purpose you stated, keep it accurate, keep it no longer than necessary, and tell people what you hold through a privacy notice.

  • Security. Controllers must apply technical and organisational measures to protect personal data. Processors, including software vendors and hosting providers acting on your instructions, must process data only on your instructions and tell you about breaches without undue delay.

  • Individual rights. People can ask for access, correction, erasure and restriction of processing, so your systems must be able to find and change one person's data.

  • Penalties. The Act provides for fines and, for some offences, imprisonment. Amounts differ by offence, so read the current text or ask a qualified adviser rather than relying on a summary.

2. Cybercrimes Act, 2015

This Act criminalises illegal access, data interference, system interference and computer-related fraud, and sets rules for electronic evidence. For an organisation it matters in two ways: staff and contractors must not exceed their authorised access, and you need logs good enough to show what happened if an incident is investigated. Keep access logs, administrator activity records and backups so that an incident can be reconstructed.

3. Sector rules for financial services

In April 2026 the BoT circulated draft Cybersecurity Guidelines for Financial Service Providers. As reported, the draft expects boards to approve a cybersecurity strategy, institutions to appoint a chief information security officer and a steering committee, to keep a cyber-risk register, and to monitor third-party technology providers. The draft is aimed at banks, mobile money operators and other BoT-regulated entities. SACCOS are generally supervised by TCDC, so confirm with TCDC which guidance applies to your society. Even where a rule does not yet bind you, these are sensible governance targets.

A practical compliance checklist

  1. Map your data. List the personal data you hold, where it lives (systems, spreadsheets, phones), who can see it and which vendors process it.

  2. Register and appoint. Register with the PDPC if you are a controller or processor, and name a person accountable for data protection.

  3. Publish a privacy notice and keep a record of how you obtain consent.

  4. Lock down access. Enforce multi-factor authentication, remove dormant accounts and review administrator rights every quarter.

  5. Test your backups. A backup you have never restored is an assumption, not a control.

  6. Write an incident plan. Decide who is told, in what order, and how evidence is preserved.

  7. Put it in vendor contracts. Require processors to act on your instructions, secure the data and report breaches promptly.

  8. Keep an evidence file. Registration certificate, data inventory, policies, training records and test results.

Questions to ask a supplier

Which of these controls do you implement, and what evidence will I receive? Where will our data be stored and who can access it? How, and how quickly, will you tell us about a breach? What happens to our data if we end the contract?

How Watabe Digital can help

We run practical readiness reviews for SACCOS, NGOs and SMEs: data mapping, access and backup checks, and an evidence pack you can show a regulator or funder. We do not certify legal compliance; where a legal opinion is needed we work with your adviser. See our cybersecurity services or book a strategy session.

References

This article is general information, not legal advice. Laws and guidelines change; verify current requirements with the PDPC, BoT, TCDC or a qualified adviser.