This article is general information, not legal advice. Speak to a Tanzanian lawyer about your specific situation.
If your website has a contact form, a newsletter sign-up or an online shop, it collects personal data: names, phone numbers, email addresses. In Tanzania that brings you under the Personal Data Protection Act, 2022.
The law in brief
The Personal Data Protection Act No. 11 of 2022 came into effect on 1 May 2023. It regulates how personal information is collected, used, stored and shared. It is overseen by the Personal Data Protection Commission (PDPC).
1. Check whether you need to register with the PDPC
Organisations that collect or process personal data are required to register with the PDPC. The registration deadline was extended twice, with a final deadline of 30 April 2025, and fines for failing to register have been reported at between TZS 100,000 and TZS 5 million. If you have not registered, speak to a lawyer now.
2. Publish a privacy notice
Your website should explain, in plain language:
- Who you are and how to contact you
- What personal data you collect, and why
- Who you share it with, including service providers such as your hosting company
- How long you keep it
- How people can see, correct or delete their data
3. Ask for consent on forms
Add a clear checkbox and a link to your privacy notice on every form that collects personal data. Do not pre-tick it.
4. Collect only what you need
If you only need a name and phone number to reply, do not ask for a date of birth or ID number. Less data means less risk.
5. Know where the data goes
Form submissions may be stored by your website host or form service, sometimes outside Tanzania. Messages sent on WhatsApp pass through Meta. Your privacy notice should say so.
6. Secure it
- Serve your site over HTTPS.
- Limit who in your team can see submissions.
- Use strong passwords and two-step login on the accounts that hold customer data.
7. Delete what you no longer need
Set a retention period and stick to it. Old enquiries from years ago are a liability, not an asset.
Every website we build includes a privacy notice, consent on forms and HTTPS as standard. See our website service, or read our own privacy notice as an example.