Serves under-18s, in Tanzania

Electronic and Postal Communications (Online Content) Regulations, 2020 (GN No. 538 of 2020), reg. 18 (children protection) · Read the law's page

• Applies to online content service providers, internet service providers, application service licensees, online content users and internet cafes.
• If you provide, have access to or host online content, use it, or operate an internet cafe, take all possible measures to ensure that children do not register, access or contribute to prohibited content (regulation 18).
• Provide users with a content-filtering mechanism and parental control (regulation 18).

Personal Data Protection Act, 2022 (Act No. 11 of 2022), s. 30 (prohibition on processing of sensitive personal data) · Read the law's page

• Obtain the data subject's prior written consent before processing genetic, biometric or other sensitive personal data, including data related to a child, and where the data subject is a minor or otherwise unable to consent, seek that consent from a parent, guardian or other legal representative.

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 15 to 18 (preventing processing, rectification, erasure and children) · Read the law's page

• This binds a data controller or data processor that receives an application from a data subject.
• When a data subject applies to prevent the processing of their personal data, acknowledge the application within seventy-two hours without charging a fee, temporarily suspend the processing and mark it as restricted on your system; then decide within seven days, giving written reasons if you reject it (regulation 15).
• When a data subject applies to rectify personal data, accept and rectify the data or reject the application within fourteen days, and give written reasons for a rejection (regulation 16).
• When a data subject applies to erase or destroy personal data, consider the application within fourteen days, and give written reasons for a rejection (regulation 17).
• Where the data subject is a child, properly identify the person exercising the right and inform the parent or guardian of the risks of processing and the protection in place (regulation 18(2)).

Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 32 to 34 (data protection officer and impact assessment) · Read the law's page

• This binds a data controller or data processor.
• Appoint a data protection officer, who prepares and submits quarterly reports on compliance to the Personal Data Protection Commission (regulation 32).
• Before processing that is likely to affect the rights and freedom of the data subject, conduct a data protection impact assessment on Form 9; it covers, among other processing, automated decision-making with significant legal effect, biometric or genetic data, sensitive personal data relating to children or vulnerable groups, large-scale processing and innovative use of new technological or organisational measures (regulation 33).
• Where the assessment indicates a possible impact, request the instructions of the Commission and attach the assessment report; if the Commission gives none within thirty days after the report is submitted, you may continue with the processing (regulation 34).

Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), reg. 5 · Read the law's page

• This binds every government institution and private entity, so it reaches any organisation that operates an information system. The Order has applied since 19 June 2026.
• Within six months from the commencement of the Order, assess your information systems with the checklist in the Second Schedule to determine whether any of them is critical information infrastructure (regulation 5(1)).
• Submit the self-assessment report to the Ministry responsible for Information and Communication Technology (regulation 5(2)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 (notification and reports) · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Notify the national CERT of any significant security breach to your systems or networks, meaning any circumstance or event having an adverse effect on their security such as a Denial of Service or Distributed Denial of Service attack, a Malware attack or a Botnet attack, together with the measures you undertook to resolve the security breach (regulation 7(f)).
• Share the key findings of each security assessment you perform with the National CERT as soon as possible (regulation 7(j)).
• Create and update a cybersecurity incidents register (regulation 7(n)).
• As a user of a computer or equipment with data processing capability, monitor your systems and networks in real time for security breaches and intrusions and report any breaches and intrusions to the Authority, and report to the Authority every quarter the implementation status of the security advisories it issues (regulation 11(e) and (f)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 as amended by GN No. 570 of 2023 · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Maintain a secure environment for your organization, Internet connectivity and internal network by maintaining updated systems that have a protection mechanism against information and computer security threats (regulation 7(a)).
• Maintain your organization's Information Communication Technology and cyber security policy for information and computer security (regulation 7(b)), and comply with the security standards, guidelines, minimum security specifications and minimum requirements the national CERT or your service providers recommend for securing your information and computer systems, or in response to threats or identified vulnerabilities (regulation 7(h), renamed 7(o) by the 2023 amendment).
• Engage licensed security penetration testers, and perform independent information security assessments at least once a year to know and apply remedial measures against your security weaknesses (regulation 7(h) and (i)).
• Protect your organization's domain names by applying secure protocols such as HTTPS and DNSSEC (regulation 7(k)).
• Establish, adopt and maintain policies, processes and procedures for managing cybersecurity incidents, implement a disaster recovery plan for restoring services after a cybersecurity incident or disaster, and create and update a cybersecurity incidents register (regulation 7(l) to (n)).
• As a user of a computer or equipment with data processing capability, perform vulnerability assessment and penetration testing of your network, systems and applications, perform security testing before any system or application moves into production, and fix identified vulnerabilities by applying patches or secure configuration (regulation 11(b) to (d)).
• As such a user, put in place documented security policies and procedures to mitigate all known risks associated with the services you offer, run cyber security awareness for your customers, and monitor and comply with the security standards and guidelines the Authority provides (regulation 11(g) to (i)).