TanzaniaCritical Information Infrastructure Order, designation, registration and owner duties
In force since .
A sector security regimes rule binding public and private bodies.
- Criminal exposure
- No
- Criminal exposure note
- The Order states no offence or penalty for a failure to meet a duty it sets.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance, Reporting, Licensing, Transfer
As of .
What it requires
- This binds the owner of a computer system that the Order designates as critical information infrastructure, and the operator for the duties stated for operators (reached by declaring that you operate an essential service). The Order has applied since .
- Register each designated critical information infrastructure with the Ministry responsible for Information and Communication Technology, on the form in the First Schedule, within six months from the commencement of the Order (regulation 4(2)).
- Carry out a risk assessment analysis every quarter and submit business continuity plans to the Ministry (regulation 6(2)).
- Take necessary steps for secure access, control and transfer of data related to the infrastructure, and host all of that data within Tanzania; seek the approval of the Minister before hosting primary or secondary data outside Tanzania (regulation 8).
- Ensure the integrity and authenticity of the data or information in the infrastructure, and ensure its storage and archiving in accordance with the Act and the relevant written laws (regulations 9 and 10).
- Ensure functional disaster recovery sites, a risk management policy, backup procedures and restoration procedures; as an operator, secure the infrastructure you operate by carrying out risk assessment (regulation 11).
- Within every six months from the date of registration, conduct an audit and inspection as part of your internal operation and submit a report to the Ministry; the Ministry also audits and inspects at least annually (regulation 12).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ministry responsible for Information and Communication Technology, which keeps the register of critical information infrastructure and audits and inspects it.
What this law does
The Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 was published in Government Notice 147 on under section 28 of the Act. The Order designates twenty-five categories of computer system as critical information infrastructure, among them the national broadband backbone, submarine cable landing stations, national internet exchange points, data centres, and national banking and financial payment systems.
The Ministry responsible for information and communication technology keeps a register of critical information infrastructure. An owner of designated critical information infrastructure must register it with the Ministry, on the form in the First Schedule, within six months from the commencement of the Order. An owner must carry out a risk assessment analysis every quarter and submit business continuity plans to the Ministry.
An owner must take necessary steps for ensuring secure access, control and transfer of data related to critical information infrastructure. An owner must host all data related to critical information infrastructure within Tanzania, and must seek the approval of the Minister before hosting primary or secondary data outside Tanzania. An owner must ensure the integrity and authenticity of data or information contained in critical information infrastructure.
An owner or operator must ensure storage and archiving of data or information relating to the infrastructure in accordance with the Act and the relevant written laws. An owner must ensure the availability of functional disaster recovery sites, a risk management policy, backup procedures and restoration procedures. An operator is in charge of operating and securing its infrastructure by carrying out risk assessment.
An owner must, within every six months from the date of registration, conduct an audit and inspection as part of its internal operation and submit a report to the Ministry. The Ministry audits and inspects critical information infrastructure annually or at a higher frequency in a particular case. The Order defines the contact person as the designated officer responsible for regulatory liaison, incident reporting, compliance coordination and day to day communication with the Ministry.
When LexLint raises it
When your app profile says your app runs an essential service, provides telecom services, handles health records, is a bank or is a payment provider.