Tanzania’s Data Protection Regulator Launches On-Site Compliance Crackdown
Dodoma, Tanzania – The Personal Data Protection Commission (PDPC) is set to commence rigorous on-site compliance inspections of institutions handling personal data from Monday, August 31, 2026. This move follows preliminary assessments that revealed significant gaps in adherence to the Personal Data Protection Act, Cap 44.
Dr. Emmanuel Mkilia, Director General of the PDPC, announced that these inspections are designed to thoroughly evaluate compliance with the Act’s provisions and to empower the Commission to take decisive action against non-compliant entities. Speaking to journalists in Dodoma, Dr. Mkilia highlighted that initial assessments, conducted via the Commission’s internal systems, identified several critical areas requiring immediate improvement.
Key challenges identified include a pervasive lack of understanding among some data collectors and processors regarding their fundamental legal obligations. Furthermore, the Commission noted instances of inaccurate information provided during the registration process and persistent difficulties in upholding the rights of data subjects. A particularly concerning finding was the irregular transfer of personal data outside Tanzania, often without adherence to the stipulated legal procedures and requirements.
“These issues, identified during our preliminary phase, form the bedrock for the forthcoming compliance inspections,” Dr. Mkilia stated. The upcoming inspections will encompass a comprehensive review of institutions’ registration status, the performance and responsibilities of appointed Data Protection Officers (DPOs), and the entire lifecycle of personal data – from collection and processing to secure storage.
The PDPC will also scrutinise the adequacy of measures implemented to safeguard personal data against loss, damage, and unauthorised access. Procedures governing the cross-border transfer of personal data will also be a focal point. Institutions found to be in violation of the Personal Data Protection Act will face a range of enforcement measures, calibrated according to the nature and severity of the breach. These may include mandatory directives for rectification, formal warning letters, and the imposition of fines as prescribed by law.
Dr. Mkilia emphasised that the initiative is not intended to impede the growth of Tanzania’s digital economy. Instead, the objective is to foster a secure digital environment that simultaneously protects the fundamental rights of data subjects. He urged all data collectors and processors to proactively ensure their registration with the PDPC, maintain strict compliance with the Act and its regulations, establish approved personal data protection policies, and diligently obtain consent from data subjects where legally mandated. “From August 31, 2026, the Commission will officially be present at the workplaces of data collectors and processors to commence these vital compliance inspections,” Dr. Mkilia concluded.
