Tanzania's Personal Data Protection Act (PDPA), Act No. 11 of 2022, has applied since 1 May 2023, and it covers cookies that identify your visitors even though it never uses the word "cookie". Before you collect personal data, the Act requires you to tell people why, on what authority and who receives it. For non-essential cookies such as analytics and advertising tags, a consent banner that explains them and lets visitors refuse is the practical way to meet that duty.
Tanzania's Personal Data Protection Act 2022
The PDPA came into force on 1 May 2023 under Government Notice No. 326 of 2023. It is supplemented by the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, published on 4 July 2023 as Government Notice No. 449C. The Personal Data Protection Commission publishes the English text of the Act and of the 2023 Regulations on its website.
Part IV of the PDPA, which governs collection and use, applies to controllers domiciled in Tanzania and to controllers outside the country when the processing takes place in Tanzania (section 22(1)). The text does not say in so many words whether a foreign website that only receives Tanzanian visitors is caught. If your site sets cookies that identify visitors in Tanzania, the safer reading is that it is.
The framework shares principles with the GDPR but includes distinct local requirements around registration, cross-border transfers and enforcement.
The Personal Data Protection Commission is up and running
The PDPA established the Personal Data Protection Commission (PDPC) as the supervisory authority. It is operational, led by Director General Dr Emmanuel Lameck Mkilia, and registers data controllers and processors through an online system.
As of August 2026, the PDPC reports 15,146 registered organisations, 445 complaints received, 121 cross-border data transfer permits and 6 determinations.
The Commission can investigate complaints, serve enforcement notices that give at least 21 days to put things right (section 45), issue penalty notices and keep a register of data controllers and processors.
Registration is a continuing duty, not a one-off deadline. Section 14 of the Act says a person shall not collect or process personal data without being registered as a data controller or data processor.
The PDPA never mentions cookies
A search of the English texts of the Act and of the 2023 Collection and Processing Regulations, as published by the PDPC and checked on 16 October 2026, finds no mention of cookies or trackers. There is no Tanzanian equivalent of Article 5(3) of the EU's ePrivacy Directive, which regulates storing information on a device as such.
Cookies fall under the PDPA when they collect personal data, and most tracking cookies do. A cookie such as _ga or _fbp carries an identifier tied to one browser, which is personal data in the hands of the site owner and the vendor. The general rules then apply:
- Section 22(2): collect personal data only for a lawful purpose related to your functions, and only where the collection is necessary for that purpose.
- Section 23(2): before collecting, make sure the person knows the purposes, that the collection is for authorised purposes, and any intended recipients.
- Section 25: use the data only for the intended purpose, unless the person authorises another use or another exception applies.
Strictly necessary cookies, such as a session cookie like PHPSESSID, usually pass the necessity test in section 22. Analytics and advertising cookies are harder to justify as necessary, and they send data to recipients the visitor has to be told about before collection starts.
What consent looks like under the PDPA and its Regulations
The Act asks for prior written consent in specific cases, such as sensitive personal data (section 30). For other processing, regulation 25(d) of the 2023 Regulations lists, among the factors of lawful processing, that the data subject understands what they consented to and has a simplified means to withdraw consent.
For a cookie banner, that points to a clear choice before non-essential cookies are set, with an explanation of each purpose and recipient, and a way to change the choice later. Pre-ticked boxes or "consent" by continued browsing are unlikely to show the understanding regulation 25(d) describes. A consent banner that blocks scripts until the visitor chooses gives you both the notice section 23 requires and a record of the decision.
Keep those records. If a complaint reaches the Commission, you will want timestamped evidence of what each visitor was told and what they chose.
Penalties and enforcement
The PDPA has both administrative and criminal penalties.
| Penalty type | Applies to | Amount in the Act |
|---|---|---|
| Administrative penalty (section 47) | Any contravention, by penalty notice | Up to TZS 100,000,000 |
| Criminal fine, individual (section 60) | Unlawful disclosure of personal data | TZS 100,000 to TZS 20,000,000, or up to 10 years' imprisonment, or both |
| Criminal fine, company (section 60) | Unlawful disclosure of personal data | TZS 1,000,000 to TZS 5,000,000,000 |
| General penalty (section 63) | Offences with no specific penalty | TZS 100,000 to TZS 5,000,000, or imprisonment |
| Compensation (section 37) | Damage caused by a contravention | No ceiling set in the Act |
Corporate criminal fines can reach TZS 5 billion, which is a serious exposure for larger organisations. The Act sets no cap on compensation to people who suffer damage.
The PDPC had published 6 determinations by August 2026. That is a small number next to 445 complaints, but it shows the Commission deciding cases, not only registering organisations.
How Tanzania's PDPA compares with the GDPR
The PDPA shares several core principles with the GDPR. Section 5 requires personal data to be processed lawfully, fairly and transparently, collected for specified purposes, limited to what is necessary, kept accurate, kept no longer than needed and kept secure. Both laws give data subjects rights of access and correction.
Key differences exist, though. The PDPA requires data controllers and processors to register with the PDPC, and regulation 32 of the 2023 Regulations requires a Data Protection Officer who submits quarterly reports on compliance to the Commission. The GDPR has no general registration requirement. A transfer of personal data out of Tanzania needs a permit from the Commission under the 2023 Regulations, whereas the GDPR relies on adequacy decisions and standard contractual clauses.
The PDPA's administrative penalties are far lower than the GDPR's maximum of €20 million or 4% of worldwide annual turnover. Tanzania's cap of TZS 100 million is modest by comparison, though criminal penalties add a dimension the GDPR lacks.
Comparison with other African data protection laws
Tanzania joins a growing group of African countries with dedicated data protection laws. Kenya's Data Protection Act 2019 set up the Office of the Data Protection Commissioner and imposes fines of up to KES 5 million. Nigeria's Data Protection Act 2023 (NDPA), signed on 12 June 2023, can link fines to annual gross revenue. Uganda's Data Protection and Privacy Act 2019 also requires registration and consent for collecting personal data.
Ghana's Data Protection Act 2012 was one of the earlier African data protection laws, and South Africa's POPIA is one of the most established frameworks on the continent. Tanzania's PDPA is newer than both, with a Commission that is now registering organisations and deciding complaints.
For website owners operating across East Africa, the details differ by country: some laws name consent for tracking directly, others, like Tanzania's, reach cookies through their general collection rules. Check each country you target rather than assuming one rule.
Checklist for website owners
If your website serves visitors in Tanzania, these steps line up with the PDPA's collection, notice and registration rules:
Audit your cookies: identify every cookie and tracker your site sets, and what each one collects. Cookie scanning can automate this and sort each cookie by purpose.
Display a cookie banner: tell visitors the purposes and recipients before non-essential cookies are placed, as section 23(2) requires, and let them refuse.
Block scripts until the visitor chooses: analytics tags, marketing pixels and social media widgets should not fire before the choice.
Provide a way to withdraw: visitors must be able to change or withdraw their consent at any time, in line with regulation 25(d).
Keep consent records: store timestamped evidence of each decision in a consent log you can export if the Commission asks.
Write a cookie policy: list which cookies your site uses, their purpose, duration and whether third parties receive the data.
Register with the PDPC: if you are a data controller or processor within the Act's reach, registration is required before you collect or process personal data (section 14).
Appoint a DPO: regulation 32 requires a Data Protection Officer who submits quarterly compliance reports to the Commission.
Short answers on Tanzania's PDPA
Does Tanzania have a data protection law?
Yes. The Personal Data Protection Act 2022 (Act No. 11 of 2022) came into force on 1 May 2023. Its Collection and Processing Regulations were published on 4 July 2023.
Do websites need cookie consent for Tanzanian visitors?
The PDPA does not mention cookies, but cookies that identify visitors collect personal data, so its rules on lawful purpose and notice before collection apply. For analytics and advertising cookies, a banner that explains them and lets visitors refuse is the practical way to meet those rules.
What are the fines for breaking Tanzania's PDPA?
The Commission can impose administrative penalties of up to TZS 100 million. Unlawful disclosure of personal data is a criminal offence, with fines of up to TZS 5 billion for companies and up to 10 years' imprisonment for individuals.
Who enforces data protection in Tanzania?
The Personal Data Protection Commission (PDPC), led by Director General Dr Emmanuel Lameck Mkilia. As of August 2026 it reports 15,146 registered organisations, 445 complaints and 6 determinations.
Is Tanzania's PDPA similar to the GDPR?
The PDPA shares core GDPR principles such as lawfulness, transparency and purpose limitation. Key differences include mandatory registration with the PDPC, quarterly reports from the Data Protection Officer and a permit system for cross-border data transfers.
Do I need to register with Tanzania's PDPC?
Yes, if you collect or process personal data within the Act's reach. Section 14 says no one may collect or process personal data without being registered, and the PDPC runs registration through its online system.
Explain your cookies to Tanzanian visitors before they are set
Kukie.io scans your site for cookies, holds analytics and marketing scripts until the visitor chooses, and keeps a record of every choice. Region rules let you show visitors from Tanzania the banner and consent model you decide on, alongside the rules you set for other countries.
