TanzaniaComputer Emergency Response Team Regulations, Security Breach Notification by Service Providers
Electronic and Postal Communications (Computer Emergency Response Team) Regulations 2018 (GN No. 60 of 2018), regs. 8, 9(2) and 12(4) (notification and reports)
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a service provider, meaning a person licensed to provide electronic communication services (regulation 8), with the added reporting duties of regulation 9(2) falling on a national application service licensee (reached by declaring that you provide telecommunications services). Government Notice No. 60 was published on and the 2023 amendment on .
- Notify the national CERT of any significant security breach to your systems or networks, meaning any circumstance or event having an adverse effect on their security such as a Denial of Service or Distributed Denial of Service attack, a Malware attack or a Botnet attack, together with the measures you undertook to prevent reoccurrence of the threat (regulation 8(c)).
- Respond effectively and in a timely way to the national CERT, and support your subscribers in a notification on significant information or computer security threats, as the national CERT's guidelines provide (regulation 8(b)).
- Submit detailed periodic reports of incidences and threats on notification, as the national CERT stipulates, giving where possible the causes of the threat, the number of subscribers affected, other harmful consequences caused by the incident and the repair time (regulation 8, paragraph (j) before and (i) after the 2023 amendment).
- Submit to the national CERT, every quarter, the volume of traffic you identified, marked and filtered as malicious, the significant exceptional situations that affected the usability of your services and the faults found in your individual subscriber base (regulation 12(4), renumbered 16(4) by the 2023 amendment).
- If you are a national application service licensee, monitor your systems and networks in real time for security breaches and intrusions and report any breaches and intrusions to the Authority, and report to the Authority every quarter the implementation status of the security advisories it issues (regulation 9(2)(e) and (g)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Regulation 13(1), renumbered regulation 17 by the 2023 amendment, makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Electronic and Postal Communications Act, and regulation 13(2) lets the Director General compound the offence by collecting a sum not exceeding the fine prescribed for it.
Who enforces it
Enforcement body
The Tanzania Communications Regulatory Authority, within whose structure the National CERT is established as a unit.
Settledness
- As of
- Open questions
- What is the amount of the fine that the Electronic and Postal Communications Act prescribes for a contravention of these Regulations under regulation 13(1)?
- Do the Computer Emergency Response Team (Amendment) Regulations, 2025 (Government Notice No. 56 of 2025) change any of the duties described here?
- By what time after discovering a significant security breach must a service provider notify the national CERT under regulation 8(c), given that the Regulations state no period?
What this law does
Government Notice No. 60, published on , makes the Regulations under section 165 of the Electronic and Postal Communications Act (Cap. 306). Government Notice No. 570, published on , amends the Regulations. Government Notice No. 56, published on , amends the Regulations again.
Regulation 3 defines a significant security breach as any circumstance or event having an adverse effect on security of constituency systems and network such as Denial of Service or Distributed Denial of Service attacks, Malware attacks, Botnet attacks or other related events. Regulation 8(c) requires a service provider to notify the national CERT of any significant security breach to the constituency systems or networks and the measures undertaken to prevent reoccurrence of the threat.
Regulation 8(b) requires a service provider to provide an effective and timely response to the national CERT and support to its subscriber base in a notification on significant information or computer security threats as per guidelines issued by the national CERT.
Regulation 8 also requires a service provider to submit detailed periodic reports of incidences and threats on notification as the national CERT stipulates, giving where possible an account of the causes of the threat, the number of subscribers affected, other harmful consequences caused by the incident and the repair time.
Regulation 12(4), renumbered 16(4), requires the service providers to compile and submit to the national CERT, on a quarterly basis, the volume of traffic identified, marked and filtered as malicious, the significant exceptional situations affecting the usability of services and the faults found in the individual subscriber base.
Regulation 9(2), added by the 2023 amendment, requires a national application service licensee to ensure real-time monitoring of systems and networks for security breaches and intrusions that may affect their network, systems and consumers, as well as reporting to the Authority of any breaches and intrusions. Regulation 9(2) also requires that licensee to implement the security advisory the Authority issues and report back to the Authority its implementation status in quarterly basis.
Regulation 13(1) makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Act. Regulations 12, 13 and 14 were renumbered as regulations 16, 17 and 18 by the 2023 amendment.
When LexLint raises it
When your app profile says your app provides telecom services.