TanzaniaComputer Emergency Response Team Regulations, Security Breach Notification by Constituencies and Users
Electronic and Postal Communications (Computer Emergency Response Team) Regulations 2018 (GN No. 60 of 2018), regs. 7 and 11 (notification and reports)
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on and the 2023 amendment on .
- Notify the national CERT of any significant security breach to your systems or networks, meaning any circumstance or event having an adverse effect on their security such as a Denial of Service or Distributed Denial of Service attack, a Malware attack or a Botnet attack, together with the measures you undertook to resolve the security breach (regulation 7(f)).
- Share the key findings of each security assessment you perform with the National CERT as soon as possible (regulation 7(j)).
- Create and update a cybersecurity incidents register (regulation 7(n)).
- As a user of a computer or equipment with data processing capability, monitor your systems and networks in real time for security breaches and intrusions and report any breaches and intrusions to the Authority, and report to the Authority every quarter the implementation status of the security advisories it issues (regulation 11(e) and (f)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Regulation 13(1), renumbered regulation 17 by the 2023 amendment, makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Electronic and Postal Communications Act, and regulation 13(2) lets the Director General compound the offence by collecting a sum not exceeding the fine prescribed for it.
Who enforces it
Enforcement body
The Tanzania Communications Regulatory Authority, within whose structure the National CERT is established as a unit.
Settledness
- As of
- Open questions
- What is the amount of the fine that the Electronic and Postal Communications Act prescribes for a contravention of these Regulations under regulation 13(1)?
- Do the Computer Emergency Response Team (Amendment) Regulations, 2025 (Government Notice No. 56 of 2025) change any of the duties described here?
- By what time after discovering a significant security breach must a constituency notify the national CERT under regulation 7(f), given that the Regulations state no period?
- Which people and organizations has the national CERT recorded as its constituencies, and does regulation 11 reach an individual end user as well as an organisation?
What this law does
Government Notice No. 60, published on , makes the Regulations under section 165 of the Electronic and Postal Communications Act (Cap. 306). Government Notice No. 570, published on , amends the Regulations. Government Notice No. 56, published on , amends the Regulations again.
Regulation 3 defines a significant security breach as any circumstance or event having an adverse effect on security of constituency systems and network such as Denial of Service or Distributed Denial of Service attacks, Malware attacks, Botnet attacks or other related events. Regulation 7(f) requires the constituencies to notify the national CERT of any significant security breach to the constituency systems or networks and the measures undertaken to resolve the security breach.
Regulation 7, as amended in 2023, requires the constituencies to share the key findings of a security assessment with the National CERT as soon as possible. Regulation 11, as substituted in 2023, requires a user of any computer or equipment with data processing capability to ensure real-time monitoring of systems and networks for security breaches and intrusions.
Regulation 11 also requires that user to implement the security advisory issued by the Authority from time to time and report back to the Authority its implementation status in quarter basis. Regulation 13(1) makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Act. Regulations 12, 13 and 14 were renumbered as regulations 16, 17 and 18 by the 2023 amendment.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.