Legal Update – 15 January 2025
Registration for Companies under Data Protection Law Extended
- New and final deadline 30 April 2025
- Fines up to TZS 5M to be imposed
The Personal Data Protection Act No. 11 of 2022 (the PDPA) which came into force on 1 May 2023 aims to regulate the collection, processing, storage and use of personal information, ensuring responsible and secure handling of individuals’ data. Further, on 12 May 2023, the Minister for Information, Communication and Technology (the Minister) issued the Personal Data Protection (Collection and Processing of Personal Data) Regulations vide Government Notice No. 349 of 2023 (the Regulations). The said Regulations provide for application and registration procedure of data controllers and data processors (data controllers) and other related matters connected thereto.
The Regulations make it mandatory for data controllers to be registered with the Personal Data Protection Commission (PDPC) prior to any collection and processing (collection) of personal data. It is important to note that the law defines data controller to mean a natural person, legal person or public body which controls/processes personal data. Therefore, all organizations, companies, entities and institutions fall into the category of a data controller and need to be registered.
Moreover, Regulation 4 requires a person who intends to collect personal data to apply for registration to the Commission through Form No. 1, and to pay relevant fees as prescribed in the Second Schedule to the Regulations. The application form should be accompanied by incorporation documents, in case of a corporate entity, and personal identification, in case of an individual.
The initial deadline to register was 6 months from the date of coming into force of the PDPA, which was further extended to 31 December 2024. However to give more time for registration, the deadline has now been extended to 30 April 2025. According to a Notice by the PDPA, this is a final extension and no further accommodations will be granted.
The PDPC Notice reminds the public that the protection of personal data is not optional and it is a legal obligation and a cornerstone of Tanzania’s commitment to a secure digital economy’s future. Failure to register attracts a fine of between TZS 100,000 and not exceeding TZS 5M.
To read the Public Notice click here
To read our previous update on Collection and Processing of Personal Data click here