Data protection
The Act applies to Mainland Tanzania and to Zanzibar, except that in Zanzibar it does not apply to non-union matters (s. 2). It covers collection and processing by manual or automated means, including by a controller outside Tanzania when the processing takes place in Tanzania (s. 22(1)); 'sensitive personal data' includes genetic and biometric data, data on children, offences and financial transactions, and data revealing ethnic origin, political opinions, religious beliefs or health, and may be processed only with the prior written consent of the data subject, which can be withdrawn at any time without explanation or charge (ss. 3 and 30). The Constitution of 1977 separately protects the privacy of a person's family, matrimonial life, residence and private communications (Art. 16(1)).
The Personal Data Protection Commission is a body corporate that registers controllers and processors, receives and investigates complaints, educates the public and monitors compliance (ss. 6 and 7). Nobody may collect or process personal data without being registered (s. 14); registration lasts five years (s. 16), public institutions that process data are deemed registered (s. 21) and an applicant aggrieved by a registration decision appeals in writing to the Minister (s. 20). The official text gives the Act, No. 11 of 2022, a commencement date of 1 May 2023 under GN No. 326 of 2023, as a note by ALN Tanzania of 15 May 2023 also reports, and the Commission's website gives its address as 1 Moshi Street, Viwandani, Dodoma.
Individuals have defined rights: to be told whether their data are processed and for what purpose, and to whom they may be disclosed (s. 33); to require a controller to suspend or not begin processing likely to cause substantial damage (s. 34); to stop use of their data for direct marketing (s. 35); to object to decisions based solely on automated processing (s. 36); and to compensation for damage, which includes damage not involving financial loss (ss. 37 and 50). The Commission may, on application, order inaccurate data to be rectified, blocked, erased or destroyed (s. 38), and a controller must notify it without undue delay of any security breach (s. 27(5)). The Act contains no stand-alone right to demand erasure from the controller: erasure comes through the Commission's orders.
A complaint to the Commission must be investigated and concluded within 90 days of receipt, extendable by up to 90 days (s. 39(3) and (4)); the Commission can summon witnesses, enter premises and examine records (s. 42), serve an enforcement notice giving at least 21 days to put matters right (s. 45), then a penalty notice of up to TSh 100 million (ss. 46 and 47), and an aggrieved person may appeal to the High Court (s. 49). Criminal liability is separate: a controller who discloses data incompatibly with the purpose of collection, anyone who obtains or discloses data without the controller's authority and anyone who offers personal data for sale risks, for an individual, a fine of TSh 100,000 to 20 million or up to ten years, and for a company a fine of TSh 1 million to 5 billion (s. 60), while unlawful destruction or alteration carries TSh 100,000 to 10 million or up to five years (s. 61).
The Act exempts processing 'by the data subject for his personal use' (s. 58(2)(a)). Online abuse between partners is handled by other texts: s. 23 of the Cybercrimes Act punishes electronic communications sent to coerce, intimidate, harass or cause emotional distress with a fine of at least TSh 5 million or at least three years, and s. 118 of the Electronic and Postal Communications Act punishes menacing or abusive communications with a fine of at least TSh 5 million or at least 12 months, plus TSh 750,000 for every day the offence continues. Both are covered again in the section on online fraud and scams.
Key points
| Statute | Personal Data Protection Act, 2022, Cap. 44 (official English version GN No. 395B of 13 June 2023) |
|---|---|
| Territory | Mainland; Zanzibar except non-union matters (s. 2) |
| Regulator | Personal Data Protection Commission, Dodoma (s. 6) |
| Registration | Compulsory before collecting or processing; certificate valid five years (ss. 14 and 16) |
| Sensitive data | Prior written consent, withdrawable at any time (s. 30) |
| Complaint | Investigated and concluded within 90 days, extendable by up to 90 (s. 39) |
| Administrative fine | Up to TSh 100 million (s. 47); appeal to the High Court (s. 49) |
| Unlawful disclosure or sale of data | Individual: TSh 100,000 to 20 million or up to 10 years, or both; company: TSh 1 million to 5 billion (s. 60(6)) |
| Processing for personal use | Exempt from the Act (s. 58(2)(a)) |
In practice
- Ask the controller in writing what data it holds on you, why and who receives it (s. 33); the Act says the procedures for the rights in ss. 34 to 36 are those 'prescribed in the regulations'.
- If the controller does not put matters right, complain to the Commission (s. 39(1)) through the 'File a complaint' link on pdpc.go.tz or by email to helpdesk@pdpc.go.tz; the Commission lists helpdesk hours of Monday to Friday, 08:00 to 16:00.
- Claim compensation for financial or non-financial damage from the controller or processor (ss. 37 and 50), and ask the Commission for an order to rectify, block, erase or destroy data (s. 38).
- Report a sale or unauthorised disclosure of your data to the police as an offence under s. 60; the court may also order forfeiture of the devices holding the data after conviction (s. 63(2)).
Where to go
- Personal Data Protection Commission, P.O. Box 1105, 1 Moshi Street, Viwandani, Dodoma; email dg@pdpc.go.tz (Director General) and helpdesk@pdpc.go.tz.
- High Court, for appeals against the Commission's enforcement or penalty notices (s. 49).
- Police, for the offences in ss. 60 and 61.
Worth knowing
Registration of the controller is a precondition for lawful processing (s. 14), but processing 'by the data subject for his personal use' is exempt (s. 58(2)(a)); a person who obtains or discloses someone else's data without the controller's authority commits an offence under s. 60(3) regardless of that exemption.
Frequently asked questions
Does the Personal Data Protection Act apply in Zanzibar?
Yes, except for non-union matters: s. 2 says it applies to Mainland Tanzania and to Zanzibar save that in Zanzibar it does not apply to non-union matters.
How long does the Commission have to decide a complaint?
It must investigate and conclude a complaint within 90 days of receiving it and may extend that period by up to 90 days (s. 39(3) and (4)).
Can I make a company erase my personal data?
The Act has no general right to ask the controller for erasure; the Commission may order erasure, blocking or destruction on the data subject's application where the data are inaccurate (s. 38) or where damage has been suffered and there is a substantial risk of further contravention (s. 37(3)).
Sources
- Personal Data Protection Act, 2022, Cap. 44 -- official English version (Government Notice No. 395B of 13 June 2023, TanzLII copy) — ss. 1 to 7, 14 to 16, 20 to 23, 27, 30, 33 to 39, 42, 45 to 50, 58, 60 to 63 (official English version)
- Constitution of the United Republic of Tanzania of 1977, text as amended to 2005 (Constitute Project) — Art. 16(1): privacy of the person, family, matrimonial life, residence and private communications
- Cybercrimes Act, Cap. 443, Revised Edition 2023 (Attorney General's Office, official revised text) — s. 23 (cyber bullying)
- Electronic and Postal Communications Act, Cap. 306, Revised Edition 2023 (Attorney General's Office, official revised text) — s. 118 (obscene, menacing or harassing communications)
- Personal Data Protection Commission (PDPC), Dodoma -- official website — address, complaint form, registration system, helpdesk and office hours
- ALN Tanzania, "Tanzania's Personal Data Protection Act comes into effect" (15 May 2023) — Act in operation from 1 May 2023 (date also printed in the official text: GN No. 326 of 2023)
The general article: Data protection · Compare with another country
Romance scams
Section 12 of the Cybercrimes Act punishes causing a loss of property to another by inputting, altering, deleting or delaying computer data, or interfering with a computer system, with fraudulent or dishonest intent, with a fine of at least TSh 20 million or three times the undue advantage (whichever is greater), or at least seven years, or both; s. 15 makes it an offence to impersonate another person using a computer system, with a fine of at least TSh 5 million or three times the advantage, or at least seven years, or both. The Penal Code covers the classic scam directly: a 'false pretence' is a representation of fact or intention that the speaker knows to be false (s. 301), and obtaining anything capable of being stolen by a false pretence with intent to defraud carries seven years (s. 302), against three years for obtaining money by a fraudulent trick or device (s. 304).
Threats follow the money. Section 23 of the Cybercrimes Act punishes sending electronic communications with intent to coerce, intimidate, harass or cause emotional distress with a fine of at least TSh 5 million or at least three years; s. 118 of the Electronic and Postal Communications Act (Cap. 306) punishes menacing or abusive communications with a fine of at least TSh 5 million or at least 12 months, plus TSh 750,000 for every day the offence continues; and the Penal Code punishes demanding anything by a writing containing threats of injury or detriment with 14 years (s. 289) and demanding a valuable thing with menaces with five years (s. 292).
Tanzanian courts can try offenders who are abroad. Under s. 30 of the Cybercrimes Act they have jurisdiction when the act is committed wholly or partly in the United Republic, by a Tanzanian national, or by any person of any nationality or location when the offence is directed against a computer system, device or data or a person located in the United Republic. On the Mainland the Director of Public Prosecutions may compound an offence before court proceedings begin if the suspect voluntarily admits it, for a sum not above the prescribed fine, and the compounding order is final and not open to appeal (s. 50).
Phones are the main channel. SIM cards and built-in-SIM handsets must be registered (EPOCA s. 93), using an unregistered SIM with intent to defraud carries a fine of at least TSh 3 million or at least six months (s. 131(1)), and TCRA's 'Kwea Kidijitali' campaign of August 2022 told users to text 'Fraud' to 15040 and then paste the scammer's number into the reply, after which law enforcement investigates the reported numbers before taking legal action. It also advised dialling *106# to see the numbers registered in one's name, calling the operator on 100 and never sending money to someone unknown.
The scale is documented. The Police Force's crime statistics for 2023, with the National Bureau of Statistics, recorded TSh 5.067 billion stolen through mobile money, bank transactions or ATM withdrawals, of which TSh 288.7 million was recovered, and 3,731 incidents compared with 2,951 in 2022, a rise of 26.4% (The Citizen, 26 July 2024).
Key points
| Computer-related fraud | Fine of at least TSh 20 million or 3 times the advantage, or at least 7 years, or both (Cybercrimes Act s. 12) |
|---|---|
| Impersonation by computer | Fine of at least TSh 5 million or 3 times the advantage, or at least 7 years, or both (s. 15) |
| Cyber bullying | Fine of at least TSh 5 million or at least 3 years, or both (s. 23) |
| False pretences (Mainland) | 7 years (Penal Code s. 302); cheating by a trick or device 3 years (s. 304) |
| Harassing or menacing communications | Fine of at least TSh 5 million or at least 12 months, plus TSh 750,000 a day (EPOCA s. 118) |
| Unregistered SIM used to defraud | Fine of at least TSh 3 million or at least 6 months (EPOCA s. 131(1)) |
| Jurisdiction | Offences directed at a person located in Tanzania can be tried whatever the offender's nationality or location (Cybercrimes Act s. 30) |
| Report a scam number | SMS 'Fraud' to 15040 (TCRA) |
| Losses recorded in 2023 | TSh 5.067 billion stolen, TSh 288.7 million recovered, 3,731 incidents (Police Force and NBS) |
In practice
- Do not send money to someone met online: TCRA's guidance is never to send money by phone to an unknown person, to check the message and number before any transaction, and to ignore calls about lotteries one did not enter.
- Text 'Fraud' to 15040 for a scam message and follow the automated instruction to paste the sender's number and resend it; TCRA describes the number as the route by which law enforcement investigates and acts on reported numbers.
- Dial *106# to see which numbers are registered under your national ID and remove any you do not recognise, as TCRA advises, and contact the service provider by dialling 100.
- File a criminal complaint at a police station; for service complaints TCRA's service desk takes calls on 0800008272 (24 hours), the USSD code *152*00#, email to dawatilahuduma@tcra.go.tz and the e-mrejesho online system.
Recent changes
The Citizen reported on 26 July 2024, citing the Police Force and NBS crime statistics for January to December 2023, that TSh 5.067 billion was stolen through mobile money, bank and ATM channels and TSh 288.7 million recovered, across 3,731 incidents against 2,951 in 2022.
Where to go
- TCRA service desk: toll-free 0800008272, USSD *152*00#, dawatilahuduma@tcra.go.tz, e-mrejesho, and walk-in at the head office, the Zanzibar office or zonal offices.
- Police station, for the criminal complaint under the Cybercrimes Act and the Penal Code.
- Mobile operator customer care, dial 100, to report and block a number.
- Personal Data Protection Commission, where the scam involved misuse of your personal data (see the personal data section).
Frequently asked questions
Is running a fake online profile to win someone's trust a crime in Tanzania?
Section 15 of the Cybercrimes Act makes it an offence to impersonate another person using a computer system, with a fine of at least TSh 5 million or at least seven years; if money is obtained, the false-pretence offence in s. 302 of the Penal Code and the fraud offence in s. 12 of the Cybercrimes Act are also in play.
Can Tanzania prosecute a scammer who lives abroad?
Yes in principle: s. 30(1)(e) of the Cybercrimes Act gives Tanzanian courts jurisdiction over any person, whatever their nationality or location, when the offence is directed against a computer system, device or data or a person located in the United Republic.
How do I report a scam text message?
Send the word 'Fraud' to 15040; TCRA's campaign page says an automated reply asks you to paste the scammer's number and resend it, and that law enforcement then investigates the reported numbers.
Sources
- Cybercrimes Act, Cap. 443, Revised Edition 2023 (Attorney General's Office, official revised text) — ss. 2, 12, 15, 23, 30 and 50
- Penal Code, Cap. 16, Revised Edition 2023 (Attorney General's Office, official revised text) — ss. 289, 292, 301, 302 and 304
- Electronic and Postal Communications Act, Cap. 306, Revised Edition 2023 (Attorney General's Office, official revised text) — ss. 93, 118 and 131
- TCRA, "TCRA launches campaign to curb online fraud" (4 August 2022) — campaign of 4 August 2022: 15040, *106#, operator line 100
- TCRA (Tanzania Communications Regulatory Authority) -- service desk — service desk channels: 0800008272, *152*00#, email, e-mrejesho
- The Citizen, "Police: Tanzanians lost Sh5 billion to cyber fraud in 2023" (26 July 2024; figures of the Police Force and NBS crime statistics report) — 2023 losses and incidents
The general article: Romance scams · Compare with another country