A customer database, an employee file, a visitor register or a CCTV recording can all place personal data in your organisation’s hands. As Tanzania’s data protection regulator begins compliance inspections, businesses should be ready to explain how that information is managed- and produce evidence to support their answers.
On 28 August 2026, the Personal Data Protection Commission (PDPC) announced that it had begun visiting institutions, organisations and businesses to assess compliance with the Personal Data Protection Act, Chapter 44. Its stated priorities include registration, the performance of Data Protection Officers, data handling and storage, international transfers, and security safeguards.
For business owners and management teams, this is a timely reason to review whether written policies reflect everyday practice.
Which businesses should pay attention?
Personal data protection concerns organisations across the economy. The PDPC identifies employee records, customer databases, identification details, health information and CCTV recordings among the information relevant to registration and compliance. A business does not need to sell data or operate a technology platform to handle personal information.
Consider a hotel collecting guest passport details, an employer maintaining payroll records, or a school holding parents’ contact information. Each should understand what information it holds, why it needs it, who can access it and where it goes.
The Act applies to Mainland Tanzania and to Zanzibar in relation to Union matters; it does not extend to non-Union matters in Zanzibar. Organisations operating across both jurisdictions should assess the scope relevant to their activities.
Registration is the starting point
The PDPC states that a person must be registered with the Commission as a data controller or processor before collecting or processing personal data. Businesses should establish the roles they perform and ensure their registration accurately reflects their operations.
However, a registration certificate cannot demonstrate how staff actually handle information. A registered organisation may still have weaknesses in access controls, supplier arrangements or internal procedures.
As a practical preparation step, management should assemble an accessible compliance file containing registration records, relevant policies, responsibility assignments and evidence that those policies are being used. An inspection is easier to manage when documents have clear owners and can be retrieved promptly.
Your Data Protection Officer must have an active role
Section 27 (3) of the Personal Data Protection Act requires the appointment of a Data Protection Officer (DPO). Regulation 32 of the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 gives that officer substantive duties, including monitoring compliance, advising on corrective measures, handling data-related applications or complaints, and preparing and submitting quarterly compliance reports to the Commission.
Management should therefore look beyond the appointment letter. Can the DPO explain the organisation’s main risks? Are concerns escalated to someone with authority to act? Are reports prepared and submitted?
A useful internal review would examine reporting records, staff guidance and examples of issues the DPO has helped resolve. The officer also needs practical access to colleagues responsible for HR, IT, procurement and customer service.
Examine everyday handling of personal information
The Commission’s announcement expressly includes how organisations collect, process and store personal data. Businesses should test their procedures against real workflows.
Start with a sample of routine activities: recruiting an employee, onboarding a customer, recording visitors or responding to a complaint. Trace the information from collection to storage, sharing and eventual disposal.
For example, a recruitment procedure may appear orderly while applicants’ CVs remain scattered across personal email accounts and messaging groups. A visitor register may expose previous visitors’ telephone numbers to everyone signing in. These examples show why reviewing the actual process can reveal issues that a policy review misses.
Record any gaps, assign a responsible person and set a realistic correction date.
Review security and service providers together
Section 27 of the Personal Data Protection Act requires reasonable safeguards against loss and unauthorised destruction, alteration, access or processing. It also requires a contractual framework governing a processor’s activities on behalf of a controller.
Practical checks should include who can open sensitive files, whether former employees retain access, how paper records are secured and whether staff know where to report a suspected incident. Controls should suit the information involved and the risks it creates.
Outsourced payroll, IT support and document storage deserve attention too. Identify which suppliers handle personal data, review their contractual responsibilities and establish who coordinates the response if something goes wrong. Avoid assuming that outsourcing a function removes the need for oversight.
Check where your data travels
International transfers are an expressly identified inspection priority. The PDPC operates a permit process requiring information about the data, purpose, destination, recipient and safeguards. Organisations intending to transfer personal data abroad should assess and fulfil the applicable requirements before proceeding.
Begin by asking cloud, HR and other software providers where information is hosted and who can access it. Overseas storage, support arrangements or sharing with a foreign group company may require closer legal assessment.
Keep a record of the relevant arrangements, assessments, agreements and permits. A supplier’s general statement that its platform is “secure” does not answer the separate question of whether the transfer requirements have been addressed.
Prepare a clear response to an inspection
The Commission has warned that identified non-compliance may result in legal action, including penalties and fines under the law. The consequences depend on the breach and applicable provisions.
As a practical measure, designate a contact person to coordinate requests, involve the DPO and relevant advisers, and maintain an accurate record of documents provided. Where gaps are identified, establish a documented corrective plan with clear responsibilities and deadlines.
Before an inspection, management should be able to answer:
Does our registration reflect our activities?
Is our DPO performing and documenting the required duties?
Can we explain how personal information moves through the business?
Have we reviewed access controls and supplier responsibilities?
Have overseas transfers been assessed and the necessary permissions obtained?
Can we demonstrate how identified weaknesses are being corrected?
These questions provide a useful starting point for an internal review; they do not replace an assessment of the organisation’s specific obligations.
How EM & Co Advocates can assist
For advice on your organisation’s obligations, inspection readiness or response to a PDPC compliance enquiry, contact EM & Co Advocates at admin@emandcoadvocates.co
