Tanzania Personal Data Protection Act 2022, PDPC and AI at work

In Dar es Salaam and Arusha alike, AI assistants are now part of everyday work tools. A freight forwarder at the port has an exchange with a Chinese client translated, a safari operator prepares quotes with ChatGPT, a bank's credit team summarises customer files with Copilot. The benefit is concrete, especially in a country where people work between Swahili and English.

But each of these uses moves data out of the company. Since the Personal Data Protection Act 2022 came into force, Tanzania has a clear framework for these flows, with a dedicated authority and precise obligations. Here is what companies need to know.

The 2022 Act and the Personal Data Protection Commission

Passed by Parliament on 1 November 2022, the Personal Data Protection Act (Act No. 11 of 2022) came into force on 1 May 2023. It establishes the Personal Data Protection Commission, the PDPC, which oversees its application. Two sets of 2023 regulations complete it: one on the collection and processing of data, the other on complaint handling.

The Act applies to public and private organisations alike. It also sets out a broad list of sensitive personal data: genetic and biometric data, data about children, information on financial transactions, health data, race or tribe, political opinions, religious or philosophical beliefs and trade union membership.

Mandatory registration with the PDPC

This is the most visible obligation in the Act. Anyone who intends to collect or process personal data in Tanzania must be registered with the Commission. The certificate is valid for five years, and renewal must be requested three months before it expires. The PDPC pushed back the registration deadline several times before setting a final date of 30 April 2025.

For a company rolling out AI, registration is not an administrative detail. It describes the processing you carry out. If your teams use AI assistants on customer or employee data, that use must be consistent with what you declared.

The penalties are not symbolic. For a company, disclosing data without consent can lead to a fine of up to 5 billion Tanzanian shillings. Officers who authorised or allowed the offence can also be held personally liable.

Transfers outside Tanzania: the real AI issue

Almost all consumer AI assistants process data on servers located outside Tanzania. In practice, every prompt containing personal data therefore becomes an international transfer.

The Act does not ban these transfers, but it regulates them. They are possible when the destination country offers adequate protection or when appropriate safeguards are in place. The Commission can also restrict transfers to certain countries, and any transfer that breaches the Act is prohibited. Additional formalities with the Commission may apply: check them before opening an external AI tool to real data.

Blocking network access to AI tools does not solve the problem, as we explain in why email and network DLP fails on ChatGPT.

AI and automated decisions: what the Act already says

Tanzania does not yet have an AI-specific law. In September 2025, the Ministry of Communication and Information Technology said it was finalising a national guideline on the responsible use of AI. But the 2022 Act already contains a very practical rule: every person has the right not to be subject to a decision based solely on automated processing.

For a bank testing AI in lending, or an HR team screening applications, this right means keeping real human involvement. It also means knowing which data the tool actually used.

The Act also gives people the right to be informed about the collection of their data and its purpose, to access it and to have it corrected. Companies must be able to answer these requests clearly, including when an AI tool was involved.

Risky situations in Tanzanian companies

• Banking and mobile money: a transaction statement pasted into an assistant to explain a dispute.

• Logistics and the port: manifests and consignee lists with names, phone numbers and ID numbers.

• Tourism: passport copies and travellers' medical details sent to draft itineraries.

• Healthcare: patient reports summarised by AI in a private clinic.

• Human resources: CVs and NIDA national ID numbers compared in bulk.

The cost of these invisible uses is detailed in the real cost of shadow AI in 2026.

An action plan for compliance

1. Confirm your PDPC certificate and check that AI use matches the processing you declared.

2. List the AI tools in use, by department and type of data.

3. Document your transfers outside Tanzania and the safeguards that cover them.

4. Keep a human in the loop for any decision affecting a customer or employee.

5. Filter data at the source, before it leaves the workstation.

To structure the rollout, use our 90-day AI DLP rollout playbook.

Summary

Tanzania has chosen a modern law, with mandatory registration, strict rules on transfers and an explicit right regarding automated decisions. ZeusLock helps companies follow these rules without giving up AI: installed on devices and browsers, it detects sensitive data in prompts and files, anonymises it while keeping its format, warns or blocks, then logs every event as compliance evidence.

Want to see how it works for your teams in Tanzania? Book a ZeusLock demo.