Tanzania

The Child Protection Laws (Miscellaneous Amendments) Act, 2024 repealed and replaced section 13 of the Cybercrimes Act, and amended section 3's definitions to add 'child sexual abuse material' or 'child sexual exploitation material', defined to mean any image, video, audio or written content depicting sexual acts involving a child or portraying a child in a sexualised manner, and to include any image, video or computer-generated material, whether created, adopted or modified, which cannot be differentiated from a real child.

As substituted, section 13 prohibits producing, offering, distributing, transmitting, procuring or knowingly possessing such material through a computer system, and prohibits compelling, inviting or allowing a child to view pornography or such material.

A person convicted is liable to a fine of not less than TZS 50,000,000 or three times the undue advantage received, whichever is greater, or imprisonment for a term of not less than seven years, or both, and may additionally be ordered to compensate the victim.

Regulation 16(1) of the Electronic and Postal Communications (Online Content) Regulations, 2020 forbids a person to publish any prohibited content set out in the Schedule to the Regulations. Government Notice 57 of 2025 was published on 28 January 2025. It added to paragraph 1 of the Schedule of prohibited content an item (d) for unethical, fabricated and artificial intelligence generated content, including video clips, audio and still pictures.

The Regulations apply to online content service providers, internet service providers, application services licensees, online content users and any other related online content. In the Regulations, the Authority is the Tanzania Communications Regulatory Authority. Licences under the Regulations include a Category B for content aggregation. A licensee must monitor and moderate user generated content to avoid publication of prohibited content.

A licensee must ensure that prohibited content is removed immediately upon being ordered by the Authority. A social media platform owner must deploy a mechanism of filtering and removing prohibited content from its platform. An internet service provider must maintain mechanisms to prevent, restrict and bar access to prohibited content through its services, and must not host prohibited content.

A contravention of the Regulations for which no specific punishment is provided is an offence punishable on conviction by a fine of not less than five million shillings or imprisonment for a term of not less than twelve months or both.

A controller or processor must ensure that personal data are processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against any loss, destruction or damage, using appropriate technical or organisational measures. In implementing the principle of security of personal data, a controller or processor must consider a list of factors set out in regulation 27.

One of the factors is having in place procedures to detect, handle, report and learn from personal data breaches. Other factors are keeping backups and logs to the extent necessary for the security of personal data, and using audit trails and events monitoring as routine security controls. Another factor is regularly reviewing and testing software to uncover vulnerabilities of the systems supporting processing. Government Notice 808 was published on 13 September 2024 and amends the Regulations.

It replaced the factor in paragraph (i) of regulation 27 with a factor to keep sensitive personal data separate from the rest of the personal data.

A data controller must protect personal data with security safeguards reasonable in the circumstances, and must notify the Personal Data Protection Commission without undue delay of any security breach affecting personal data being processed by or on behalf of the controller. The Act sets no fixed notification deadline and imposes no separate statutory duty on the controller to notify the affected data subject directly.

A controller or processor must appoint a data protection officer. The data protection officer's duties include preparing and submitting quarterly reports on compliance to the Commission. Where processing is likely to affect the rights and freedom of the data subject, the controller or processor must conduct an impact assessment before carrying out the processing.

The assessment covers, among other processing, automated decision-making with significant legal effect, processing of biometric or genetic data, processing of sensitive personal data relating to children or vulnerable groups, large-scale processing of personal data and innovative use of new technological or organisational measures. The controller or processor conducts the assessment on Form 9.

Where the results of the assessment indicate a possible impact on the processing, the processor must request the instructions of the Commission and attach the assessment report. If the Commission gives no instructions within thirty days after the report is submitted, the processor may continue with the processing.

A controller or processor must ensure that personal data are collected or processed lawfully, fairly and transparently, are collected for a legitimate and specified purpose, and are adequate and necessary for that purpose. Personal data must also be accurate and kept up to date, and stored in a form that permits identification of the data subject for no longer than is necessary for the purpose of the processing.

In processing personal data, a controller or processor must establish a personal data protection mechanism or design technical measures to safeguard and implement the principles of protection of personal data. In implementing the principle of lawfulness, a controller or processor must consider whether the data subject understands what they consented to and has a simplified means to withdraw consent.

The Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 were published as Government Notice 449C on 4 July 2023. A person may not collect or process personal data without being registered with the Commission as a data controller or data processor. A person who intends to collect or process personal data applies to the Commission on Form 1 and pays the fees in the Second Schedule.

A registration is valid for five years from the date the registration certificate is issued. A controller or processor may renew the registration by applying to the Commission within three months before the date of expiry. A controller or processor that misses the renewal period must apply for a new registration. A controller or processor must notify the Commission in writing within fourteen days after any change of the information entered in the register.

The Personal Data Protection Act, 2022 establishes the Personal Data Protection Commission and requires every data controller or processor to process personal data lawfully, fairly and transparently, collected for explicit, specified and legitimate purposes.

A person may not collect or process personal data without first registering as a data controller or data processor with the Commission, and public institutions that collect or process personal data are deemed registered from the Act's commencement. The Act applies to Mainland Tanzania and to Tanzania Zanzibar, except that in Zanzibar it does not reach non-union matters.

A controller or processor that intends to transfer personal data outside the country must apply to the Commission for a permit on Form 7. The applicant must submit proof that the receiving country has ratified an international agreement on the protection of personal data, that an agreement between Tanzania and the receiving country covers it, or that a contract exists with the recipient outside the country.

The Commission considers the application within fourteen days after receiving it and may accept or reject it. A permit is subject to four conditions: the data go only to the recipient the permit authorises, are processed only for the intended purpose, are not disclosed or transferred to another recipient without the approval of the Commission, and are not processed abroad in violation of the laws of the country.

Personal data may be transferred to a country with an adequate personal-data-protection legal framework where the recipient establishes that the transfer is necessary and can subsequently verify that necessity, and the data controller ensures the recipient processes the data only for the purpose for which it was transferred.

A transfer to a country without such a framework is permitted only where an adequate level of protection is otherwise ensured and the data is transferred solely to permit authorised processing.

Where a decision that significantly affects a data subject is based solely on processing by automatic means, the controller or processor must notify the data subject in writing about the processing. The notification must state, among other things, basic information about the processing and its intended purpose, the effects likely to arise and how they will be handled, and the data subject's right to object to the use of their personal data in commercial advertisements. The data subject has the right to reject the use of their personal data in a decision made by automatic means.

When a data subject applies to prevent the processing of their personal data, the controller or processor must within seventy-two hours, without charging a fee, acknowledge receipt, temporarily suspend the processing and indicate on the system that the processing is restricted. Within seven days from the temporary suspension, the controller or processor must consider the application and may accept it, or reject it if it is of the opinion that the application is unreasonable.

A controller or processor that rejects the application must notify the applicant in writing and explain the reasons for the rejection. A controller or processor must, within fourteen days after receiving an application to rectify personal data, accept and rectify the data or reject the application. A controller or processor that rejects an application to rectify personal data must notify the data subject in writing and give reasons.

A controller or processor must, within fourteen days, consider an application to erase or destroy personal data. A controller or processor that rejects an application to erase or destroy personal data must notify the data subject in writing and give the reasons for the rejection. Where the data subject is a child, the controller or processor must ensure that the person exercising the right is properly identified.

The controller or processor must also ensure that the parent or guardian of the child is informed of the risks of processing and the protection in place.

Section 36 lets a data subject require a controller to ensure that a decision significantly affecting them is not based solely on automatic processing. Where such a decision is made, the controller must notify the data subject as soon as practicable, and the data subject may require the controller to reconsider it. The section does not apply to a decision necessary for a contract with the data subject, authorised by written law, or based on their explicit consent.

Section 33(1)(c) entitles a data subject to be told the logic involved where automatic evaluation of matters relating to them is the sole basis of a decision significantly affecting them.

Section 33 entitles a data subject to be told whether a controller is processing their personal data and to a description of the data, the purposes of the processing and its recipients. Section 34 lets a data subject require a controller to suspend or not begin processing that is likely to cause substantial damage. Section 35 lets a data subject require a controller to stop processing their personal data for direct marketing.

Section 37 entitles a data subject who suffers damage from any contravention of the Act to compensation from the controller or processor. Section 38 lets the Commission, on a data subject's application, order inaccurate personal data rectified, blocked, erased or destroyed, and requires the controller to notify the third parties it was disclosed to.

A person who contravenes the Regulations commits an offence and on conviction is liable to the penalty stipulated in the Act. A data subject or any interested person who is aggrieved or affected by processing, or by a decision relating to personal data, made contrary to the Act or the Regulations may submit a complaint to the Commission.

The Commission may cancel a registration after satisfying itself that the controller or processor gave false or misleading information, violated the terms and conditions of registration, repeated an offence, or refused to pay a fine within the time given. After receiving the Commission's notice of intended cancellation, a controller or processor must give reasons within seven days why its registration should not be cancelled.

A controller or processor aggrieved by a decision of the Commission may appeal in writing to the Minister within seven days from the date of the decision, and the decision of the Minister is final. The Commission conducts periodic audits to monitor compliance with the data protection impact assessment report and with any recommendations or instructions it has given.

A person may complain to the Commission of a violation of the personal-data-protection principles, and the Commission may investigate, issue an enforcement notice, and impose an administrative penalty of up to TZS 100,000,000 for a contravention of the Act. A person aggrieved by the Commission's decision may appeal to the High Court.

Separate criminal offences attach to specific conduct: unlawfully selling or disclosing personal data, and unlawfully destroying, deleting, concealing or altering personal data, each carrying its own fine and imprisonment range, and any other contravention with no specifically stated penalty carries a general penalty.

Sensitive personal data, defined to include genetic data, data related to children, data related to offences, financial transactions, security measures and biometric data, may not be processed without the data subject's prior written consent, which may be withdrawn at any time without explanation or charge.

The Minister may by regulation determine circumstances in which the prohibition cannot be removed even with the data subject's consent, and where the data subject is a minor, a person of unsound mind, or another person unable to consent, consent must instead be sought from a parent, guardian or other legal representative.

Section 4 prohibits intentionally and unlawfully accessing or causing a computer system to be accessed, carrying a fine of not less than TZS 3,000,000 or three times the undue advantage received, or imprisonment of not less than one year, or both. Section 5 separately prohibits remaining in a computer system beyond authorised time. Section 6 prohibits illegal interception of non-public transmissions or electromagnetic emissions.

Section 7 prohibits illegal data interference, including damaging, deleting or altering computer data, carrying a fine of not less than TZS 10,000,000 or imprisonment of not less than three years, or both. Section 8 prohibits data espionage, obtaining computer data protected against unauthorised access, carrying imprisonment of not less than five years. Section 9 prohibits illegal system interference, hindering the functioning or usage of a computer system.

Unlike a statute that conditions the illegal-access offence on defeating a security measure, section 4's text requires only that the access be intentional and unlawful, without an express security-circumvention element, and no reported Tanzanian decision has addressed whether reading a public, unauthenticated page without authorisation from the site operator falls within the offence.

Tanzania has no sui generis database right. A compilation of data or a database is protected as a derivative literary or artistic work only where the selection or arrangement of its contents constitutes an intellectual creation, the same threshold the Act applies to encyclopaedias and anthologies, and that protection is without prejudice to any protection in the underlying, pre-existing data compiled.

The Personal Data Protection Act, 2022 applies to any collection and processing of personal data performed wholly or partly by manual or automated means, by a controller domiciled in Tanzania or otherwise reached by the Act, with no carve-out for personal data that is otherwise publicly accessible.

Scraping personal data from a public Tanzanian website therefore remains subject to the Act's registration, lawful-basis, and cross-border-transfer duties, and biometric data is a sensitive personal data category carrying a heightened prior-written-consent requirement.

Government Notice No. 60, published on 23 February 2018, makes the Regulations under section 165 of the Electronic and Postal Communications Act (Cap. 306). Government Notice No. 570, published on 11 August 2023, amends the Regulations. Government Notice No. 56, published on 31 January 2025, amends the Regulations again. Regulation 2 applies the Regulations to electronic communication operators, internet service providers and users.

Regulation 3 defines a service provider as a person licensed to provide electronic communication services. Regulation 8(a) requires a service provider to provide a secure environment for the connectivity of its subscriber base by maintaining updated systems that have a protection mechanism against information security threats.

Regulation 8 also requires a service provider to establish and maintain internal processes to handle various cyber security attacks that may endanger the security of the cyber space or the usability of the communication services and the communication network.

Regulation 9(1) requires the constituencies and application service licensees to maintain up to date and reliable mechanisms for identifying the sources of malicious traffic from the incoming or outgoing traffic and to filter such traffic that it has identified as malicious traffic.

Regulation 9(2), added by the 2023 amendment, requires a national application service licensee to perform vulnerability assessment and penetration testing of its network, systems and applications at least twice a year. Regulation 9(2) also requires a national application service licensee to conduct a cyber security risk assessment at least twice a year and maintain an updated risk register.

Regulation 13(1) makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Act. Regulations 12, 13 and 14 were renumbered as regulations 16, 17 and 18 by the 2023 amendment.

Government Notice No. 60, published on 23 February 2018, makes the Regulations under section 165 of the Electronic and Postal Communications Act (Cap. 306). Government Notice No. 570, published on 11 August 2023, amends the Regulations. Government Notice No. 56, published on 31 January 2025, amends the Regulations again. Regulation 2 applies the Regulations to electronic communication operators, internet service providers and users.

Regulation 3 defines a constituency as the people or organizations that the CERT is designed to serve or support. Regulation 7 requires the constituencies to maintain a secure environment for their organizations, Internet connectivity and internal network by maintaining updated systems that have a protection mechanism against information and computer security threats.

Regulation 7 also requires the constituencies to maintain an organization's Information Communication Technology and cyber security policy for information and computer security. Regulation 7, as amended in 2023, requires the constituencies to engage licensed security penetration testers and to perform independent information security assessments at least once a year.

Regulation 7, as amended in 2023, also requires the constituencies to establish, adopt and maintain policies, processes and procedures for managing cybersecurity incidents, to implement a disaster recovery plan and to create and update a cybersecurity incidents register.

Regulation 11, as substituted in 2023, requires a user of any computer or equipment with data processing capability to perform vulnerability assessment and penetration testing of its network, systems and applications and to fix the identified vulnerability by applying patches or secure configuration. Regulation 13(1) makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Act. Regulations 12, 13 and 14 were renumbered as regulations 16, 17 and 18 by the 2023 amendment.

The Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 was published in Government Notice 147 on 19 June 2026 under section 28 of the Act. The Order designates twenty-five categories of computer system as critical information infrastructure, among them the national broadband backbone, submarine cable landing stations, national internet exchange points, data centres, and national banking and financial payment systems.

The Ministry responsible for information and communication technology keeps a register of critical information infrastructure. An owner of designated critical information infrastructure must register it with the Ministry, on the form in the First Schedule, within six months from the commencement of the Order. An owner must carry out a risk assessment analysis every quarter and submit business continuity plans to the Ministry.

An owner must take necessary steps for ensuring secure access, control and transfer of data related to critical information infrastructure. An owner must host all data related to critical information infrastructure within Tanzania, and must seek the approval of the Minister before hosting primary or secondary data outside Tanzania. An owner must ensure the integrity and authenticity of data or information contained in critical information infrastructure.

An owner or operator must ensure storage and archiving of data or information relating to the infrastructure in accordance with the Act and the relevant written laws. An owner must ensure the availability of functional disaster recovery sites, a risk management policy, backup procedures and restoration procedures. An operator is in charge of operating and securing its infrastructure by carrying out risk assessment.

An owner must, within every six months from the date of registration, conduct an audit and inspection as part of its internal operation and submit a report to the Ministry. The Ministry audits and inspects critical information infrastructure annually or at a higher frequency in a particular case. The Order defines the contact person as the designated officer responsible for regulatory liaison, incident reporting, compliance coordination and day to day communication with the Ministry.

The Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 was published in Government Notice 147 on 19 June 2026 under section 28 of the Act. Every government institution and private entity must, within six months from the commencement of the Order, conduct a self-assessment of its information systems with the checklist in the Second Schedule to determine whether they are critical information infrastructure.

After the self-assessment, the government institution or private entity must submit a self-assessment report to the Ministry. The Ministry evaluates the report and determines whether the system may be designated as critical information infrastructure.

Government Notice No. 60, published on 23 February 2018, makes the Regulations under section 165 of the Electronic and Postal Communications Act (Cap. 306). Government Notice No. 570, published on 11 August 2023, amends the Regulations. Government Notice No. 56, published on 31 January 2025, amends the Regulations again.

Regulation 3 defines a significant security breach as any circumstance or event having an adverse effect on security of constituency systems and network such as Denial of Service or Distributed Denial of Service attacks, Malware attacks, Botnet attacks or other related events. Regulation 7(f) requires the constituencies to notify the national CERT of any significant security breach to the constituency systems or networks and the measures undertaken to resolve the security breach.

Regulation 7, as amended in 2023, requires the constituencies to share the key findings of a security assessment with the National CERT as soon as possible. Regulation 11, as substituted in 2023, requires a user of any computer or equipment with data processing capability to ensure real-time monitoring of systems and networks for security breaches and intrusions.

Regulation 11 also requires that user to implement the security advisory issued by the Authority from time to time and report back to the Authority its implementation status in quarter basis. Regulation 13(1) makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Act. Regulations 12, 13 and 14 were renumbered as regulations 16, 17 and 18 by the 2023 amendment.

Government Notice No. 60, published on 23 February 2018, makes the Regulations under section 165 of the Electronic and Postal Communications Act (Cap. 306). Government Notice No. 570, published on 11 August 2023, amends the Regulations. Government Notice No. 56, published on 31 January 2025, amends the Regulations again.

Regulation 3 defines a significant security breach as any circumstance or event having an adverse effect on security of constituency systems and network such as Denial of Service or Distributed Denial of Service attacks, Malware attacks, Botnet attacks or other related events. Regulation 8(c) requires a service provider to notify the national CERT of any significant security breach to the constituency systems or networks and the measures undertaken to prevent reoccurrence of the threat.

Regulation 8(b) requires a service provider to provide an effective and timely response to the national CERT and support to its subscriber base in a notification on significant information or computer security threats as per guidelines issued by the national CERT.

Regulation 8 also requires a service provider to submit detailed periodic reports of incidences and threats on notification as the national CERT stipulates, giving where possible an account of the causes of the threat, the number of subscribers affected, other harmful consequences caused by the incident and the repair time.

Regulation 12(4), renumbered 16(4), requires the service providers to compile and submit to the national CERT, on a quarterly basis, the volume of traffic identified, marked and filtered as malicious, the significant exceptional situations affecting the usability of services and the faults found in the individual subscriber base.

Regulation 9(2), added by the 2023 amendment, requires a national application service licensee to ensure real-time monitoring of systems and networks for security breaches and intrusions that may affect their network, systems and consumers, as well as reporting to the Authority of any breaches and intrusions. Regulation 9(2) also requires that licensee to implement the security advisory the Authority issues and report back to the Authority its implementation status in quarterly basis.

Regulation 13(1) makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Act. Regulations 12, 13 and 14 were renumbered as regulations 16, 17 and 18 by the 2023 amendment.

Made by the Tanzania Communications Regulatory Authority under section 103 of the Electronic and Postal Communications Act (Cap. 306), these Regulations apply to online content service providers, internet service providers, application service licensees, online content users and other related online content.

Regulation 18 requires any person who provides, has access to, hosts, uses online content, or operates an internet cafe to take all possible measures to ensure that children do not register, access or contribute to prohibited content, and that users are provided with a content-filtering mechanism and parental control.

The Regulations carry a general penalty for any contravention for which no specific punishment is provided, and were published in the Gazette on 17 July 2020, revoking the prior 2018 online content Regulations. Government Notice 57 of 2025 amended the Regulations to add a duty on internet service providers to bar access to prohibited content (regulation 9A) and a duty on social media platform owners to filter and remove prohibited content (regulation 15A).

Government Notice 158i of 2026, in operation from 1 July 2026, amended the Regulations to add a licence category for amateur online media services.

Where an article on current economic, political or religious topics has been published in a newspaper or periodical, or broadcast or distributed by cable, the reproduction of that article in the press, or its communication to the public, is permitted free of the author's consent unless the original publication carried an express prohibition on such use, and provided the source is clearly indicated when the article is used in that manner.

Separately, for the purpose of reporting a current event by photography, cinematography or communication to the public, reproduction of a work that can be seen or heard in the course of that event is permitted to the extent justified by the informatory purpose. Neither exception is capped at a headline-length or short-extract threshold, and no reported Tanzanian decision has tested whether either reaches a systematic news aggregator's reproduction of headlines and snippets.