Provides telecom services, in Tanzania

Electronic and Postal Communications (Online Content) Regulations, 2020 (GN No. 538 of 2020), reg. 16 and the Schedule of prohibited content, as amended by GN No. 57 of 2025 · Read the law's page

• This binds a person who publishes content online for an audience in Tanzania, including an online content service provider, an application services licensee, an internet service provider and a social media platform owner. The item on artificial intelligence generated content has applied since 28 January 2025.
• Do not publish unethical, fabricated or artificial intelligence generated content, including video clips, audio and still pictures, which the Schedule of prohibited content lists under paragraph 1(d) (regulation 16(1)).
• If you hold an online content licence, monitor and moderate user generated content to avoid publication of prohibited content, and remove prohibited content immediately when the Tanzania Communications Regulatory Authority orders it (regulation 9).
• If you own a social media platform, deploy a mechanism of filtering and removing prohibited content from the platform (regulation 15A).
• If you are an internet service provider, maintain mechanisms to prevent, restrict and bar access to prohibited content through your services, and do not host prohibited content (regulation 9A).

Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), reg. 5 · Read the law's page

• This binds every government institution and private entity, so it reaches any organisation that operates an information system. The Order has applied since 19 June 2026.
• Within six months from the commencement of the Order, assess your information systems with the checklist in the Second Schedule to determine whether any of them is critical information infrastructure (regulation 5(1)).
• Submit the self-assessment report to the Ministry responsible for Information and Communication Technology (regulation 5(2)).

Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), regs. 3, 4 and 6 to 12 · Read the law's page

• This binds the owner of a computer system that the Order designates as critical information infrastructure, and the operator for the duties stated for operators (reached by declaring that you operate an essential service). The Order has applied since 19 June 2026.
• Register each designated critical information infrastructure with the Ministry responsible for Information and Communication Technology, on the form in the First Schedule, within six months from the commencement of the Order (regulation 4(2)).
• Carry out a risk assessment analysis every quarter and submit business continuity plans to the Ministry (regulation 6(2)).
• Take necessary steps for secure access, control and transfer of data related to the infrastructure, and host all of that data within Tanzania; seek the approval of the Minister before hosting primary or secondary data outside Tanzania (regulation 8).
• Ensure the integrity and authenticity of the data or information in the infrastructure, and ensure its storage and archiving in accordance with the Act and the relevant written laws (regulations 9 and 10).
• Ensure functional disaster recovery sites, a risk management policy, backup procedures and restoration procedures; as an operator, secure the infrastructure you operate by carrying out risk assessment (regulation 11).
• Within every six months from the date of registration, conduct an audit and inspection as part of your internal operation and submit a report to the Ministry; the Ministry also audits and inspects at least annually (regulation 12).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 (notification and reports) · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Notify the national CERT of any significant security breach to your systems or networks, meaning any circumstance or event having an adverse effect on their security such as a Denial of Service or Distributed Denial of Service attack, a Malware attack or a Botnet attack, together with the measures you undertook to resolve the security breach (regulation 7(f)).
• Share the key findings of each security assessment you perform with the National CERT as soon as possible (regulation 7(j)).
• Create and update a cybersecurity incidents register (regulation 7(n)).
• As a user of a computer or equipment with data processing capability, monitor your systems and networks in real time for security breaches and intrusions and report any breaches and intrusions to the Authority, and report to the Authority every quarter the implementation status of the security advisories it issues (regulation 11(e) and (f)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 as amended by GN No. 570 of 2023 · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Maintain a secure environment for your organization, Internet connectivity and internal network by maintaining updated systems that have a protection mechanism against information and computer security threats (regulation 7(a)).
• Maintain your organization's Information Communication Technology and cyber security policy for information and computer security (regulation 7(b)), and comply with the security standards, guidelines, minimum security specifications and minimum requirements the national CERT or your service providers recommend for securing your information and computer systems, or in response to threats or identified vulnerabilities (regulation 7(h), renamed 7(o) by the 2023 amendment).
• Engage licensed security penetration testers, and perform independent information security assessments at least once a year to know and apply remedial measures against your security weaknesses (regulation 7(h) and (i)).
• Protect your organization's domain names by applying secure protocols such as HTTPS and DNSSEC (regulation 7(k)).
• Establish, adopt and maintain policies, processes and procedures for managing cybersecurity incidents, implement a disaster recovery plan for restoring services after a cybersecurity incident or disaster, and create and update a cybersecurity incidents register (regulation 7(l) to (n)).
• As a user of a computer or equipment with data processing capability, perform vulnerability assessment and penetration testing of your network, systems and applications, perform security testing before any system or application moves into production, and fix identified vulnerabilities by applying patches or secure configuration (regulation 11(b) to (d)).
• As such a user, put in place documented security policies and procedures to mitigate all known risks associated with the services you offer, run cyber security awareness for your customers, and monitor and comply with the security standards and guidelines the Authority provides (regulation 11(g) to (i)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 8 and 9 as amended by GN No. 570 of 2023 · Read the law's page

• This binds a service provider, meaning a person licensed to provide electronic communication services (regulation 8), and an application service licensee (regulation 9(1)), with the added duties of regulation 9(2) falling on a national application service licensee (reached by declaring that you provide telecommunications services). Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Provide a secure environment for the connectivity of your subscriber base by maintaining updated systems that have a protection mechanism against information security threats (regulation 8(a)).
• Establish and maintain internal processes to handle the cyber security attacks that may endanger the security of the cyber space or the usability of your communication services and network, and collaborate and cooperate with the national CERT in incident handling (regulation 8).
• Abide by the CERT guidelines and directives that the Authority prescribes from time to time, and disconnect a subscriber from the network where the national CERT proves that the subscriber endangers the security of the cyber space, under the CERT's predefined guidelines (regulation 8).
• Maintain up to date and reliable mechanisms for identifying the sources of malicious traffic in your incoming and outgoing traffic, and filter the traffic you identify as malicious (regulation 9(1)).
• If you are a national application service licensee, maintain cybersecurity personnel for cyber incident response, and perform vulnerability assessment and penetration testing of your network, systems and applications at least twice a year (regulation 9(2)(a) and (b)).
• If you are a national application service licensee, perform security testing before any system or application moves into production, fix the vulnerabilities you identify by applying patches or secure configuration, and conduct a cyber security risk assessment at least twice a year while maintaining an updated risk register (regulation 9(2)(c), (d) and (k)).
• If you are a national application service licensee, put in place documented security policies and procedures to mitigate all known risks associated with your services, and take all required security measures to guarantee the confidentiality, integrity and availability of your network, systems and services for the entire duration of the licence (regulation 9(2)(h) and (j)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 8, 9(2) and 12(4) (notification and reports) · Read the law's page

• This binds a service provider, meaning a person licensed to provide electronic communication services (regulation 8), with the added reporting duties of regulation 9(2) falling on a national application service licensee (reached by declaring that you provide telecommunications services). Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Notify the national CERT of any significant security breach to the constituency systems or networks, meaning the systems and networks of the people and organizations the national CERT is designed to serve or support, where a significant security breach is any circumstance or event having an adverse effect on their security such as a Denial of Service or Distributed Denial of Service attack, a Malware attack or a Botnet attack, together with the measures you undertook to prevent reoccurrence of the threat (regulation 8(c)).
• Respond effectively and in a timely way to the national CERT, and support your subscribers in a notification on significant information or computer security threats, as the national CERT's guidelines provide (regulation 8(b)).
• Submit detailed periodic reports of incidences and threats on notification, as the national CERT stipulates, giving where possible the causes of the threat, the number of subscribers affected, other harmful consequences caused by the incident and the repair time (regulation 8, paragraph (j) before and (i) after the 2023 amendment).
• Submit to the national CERT, every quarter, the volume of traffic you identified, marked and filtered as malicious, the significant exceptional situations that affected the usability of your services and the faults found in your individual subscriber base (regulation 12(4), renumbered 16(4) by the 2023 amendment).
• If you are a national application service licensee, monitor your systems and networks in real time for security breaches and intrusions and report any breaches and intrusions to the Authority, and report to the Authority every quarter the implementation status of the security advisories it issues (regulation 9(2)(e) and (g)).