TanzaniaCritical Information Infrastructure Order, self-assessment by government institutions and private entities
In force since .
A sector security regimes rule binding public and private bodies.
- Criminal exposure
- No
- Criminal exposure note
- The Order states no offence or penalty for a failure to meet a duty it sets.
- Instrument type
- a regulation made under an act
- Obligation class
- Governance, Reporting
As of .
What it requires
- This binds every government institution and private entity, so it reaches any organisation that operates an information system. The Order has applied since .
- Within six months from the commencement of the Order, assess your information systems with the checklist in the Second Schedule to determine whether any of them is critical information infrastructure (regulation 5(1)).
- Submit the self-assessment report to the Ministry responsible for Information and Communication Technology (regulation 5(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ministry responsible for Information and Communication Technology, which keeps the register of critical information infrastructure and audits and inspects it.
What this law does
The Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 was published in Government Notice 147 on under section 28 of the Act. Every government institution and private entity must, within six months from the commencement of the Order, conduct a self-assessment of its information systems with the checklist in the Second Schedule to determine whether they are critical information infrastructure.
After the self-assessment, the government institution or private entity must submit a self-assessment report to the Ministry. The Ministry evaluates the report and determines whether the system may be designated as critical information infrastructure.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, records calls, records text chat or tracks devices.