Law / Tanzania

Personal Data Protection (Collection and Processing) Regulations, processing obligations and protection by design

Personal Data Protection (Personal Data Collection and Processing) Regulations 2023 (GN No. 449C of 2023), regs. 23 to 25 (processing obligations, protection by design and lawfulness)

In force since 4 Jul 2023.

A comprehensive regime rule binding public and private bodies.

Instrument type: a regulation made under an act
Obligation class: Governance, Consent, Disclosure

As of 24 October 2026.

What it requires

This binds a data controller or data processor.
Collect and process personal data lawfully, fairly and transparently, for a legitimate and specified purpose, and only as far as it is adequate and necessary for that purpose (regulation 23(a) to (c)).
Keep personal data accurate and up to date, and keep them in a form that permits identification of the data subject no longer than is necessary for the purpose of the processing (regulation 23(d) and (e)).
In processing personal data, establish a personal data protection mechanism or design technical measures to safeguard and implement the principles of protection of personal data (regulation 24).
In implementing the principle of lawfulness, consider whether the data subject understands what they consented to and has a simplified means to withdraw consent (regulation 25(d)).

These lines are LexLint's reading of the law's text, as of 24 October 2026.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

A controller or processor must ensure that personal data are collected or processed lawfully, fairly and transparently, are collected for a legitimate and specified purpose, and are adequate and necessary for that purpose. Personal data must also be accurate and kept up to date, and stored in a form that permits identification of the data subject for no longer than is necessary for the purpose of the processing.

In processing personal data, a controller or processor must establish a personal data protection mechanism or design technical measures to safeguard and implement the principles of protection of personal data. In implementing the principle of lawfulness, a controller or processor must consider whether the data subject understands what they consented to and has a simplified means to withdraw consent.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.

Back to the example · Lint your app