PDPC registration Tanzania: what your website must say and do

A business website is a small data system. The contact form stores a name and a phone number. The WhatsApp button hands a visitor's number to your team. The newsletter keeps an email list. Each one is personal data in the hands of your company, and Tanzanian law now treats that as a regulated activity.

The Personal Data Protection Commission (PDPC) set 8 April 2026 as its final registration deadline and said enforcement would follow on 9 April, according to a Daily News report of 26 March 2026. That date has passed. This guide sets out what a site owner must register, publish and keep, with the section numbers so an advocate can check each point.

What the law or standard says about a business website

The main text is the Personal Data Protection Act, 2022 (Act No. 11 of 2022), printed as Cap. 44 in the revised edition. The Act text on the Attorney General's portal carries the date 1 May 2023. Two sets of regulations sit under it. The collection and processing rules are in GN 449C of 4 July 2023, also on TanzLII. The complaints procedure is a separate instrument, GN 449B of 2023.

The provisions that touch a website are these.

• Section 3 defines personal data, sensitive personal data, controller and processor.
• Section 5 sets eight principles, including lawful and transparent processing, minimal data and limited storage.
• Section 14 requires registration before any collection or processing.
• Section 23(2) requires the person to know the purpose and the recipients before collection.
• Section 27 covers security, the data protection officer, processor contracts and breach reports.
• Sections 31 and 32 govern data sent abroad, and sections 33 to 38 give people their rights.
• Section 65 asks every controller to put a code of ethics or policy in place and submit it to the Commission.

As read, the Act does not use the words cookie, website, online or analytics. Rules for banners and trackers therefore come from the general principles, not from a named duty. Where this guide goes beyond the text, it says so.

Who should read this

This guide is for owners, marketing leads and finance managers of Tanzanian companies, consultancies, clinics, schools and shops that run a site or a WhatsApp enquiry line. It also suits web managers who inherited a privacy page nobody has read. Foreign firms that serve Tanzanian visitors should read the section on who must register, because section 22(1)(c) reaches some operators without a local office.

Who must register for PDPC registration Tanzania?

Section 14(1) says a person must not collect or process personal data without being registered as a data controller or data processor. A controller decides why and how the data is used. A processor handles it for the controller. Your web host, newsletter tool and form vendor are normally processors for you. A web agency that runs your form back end can be a processor too. Zatra explains the split in its controller and processor guide.

The text sets no exemption for small firms. The fee scale starts at one employee, which suggests small businesses were expected to register. Press notices from the PDPC list banks, schools, tourism firms, law and accounting firms, media and religious bodies, as reported by The Chanzo on 27 March 2026. Public institutions are treated as registered under section 21.

Foreign operators are not outside the net. Section 22(1)(c) applies Part IV to a controller or processor not domiciled in Tanzania that processes data in the country, except for mere transit. Zatra covers that case in its guide on serving Tanzanian customers from abroad. Staff files are personal data too, covered in Zatra's note on employee data.

How does registration work, and what does it cost?

The steps below follow GN 449C. The PDPC's own site could not be opened by our tools, so the portal route is reported by Rive & Co (9 September 2024), which names an online system called RCMIS. Confirm the current portal address with the PDPC.

1. Appoint a data protection officer. Section 27(3) and regulation 32 require one, and the register lists the officer's details.
2. File Form No. 1 with the Second Schedule fee (regulation 4). A company attaches its certificate of incorporation. An individual attaches an identity document.
3. The Commission checks the file within seven days (regulation 5). It may return it for correction or reject it with written reasons within fourteen days (regulation 6).
4. On approval the PDPC issues a certificate on Form No. 2, valid for five years (section 16, regulation 7).
5. Report any change to the register within fourteen days (regulation 10).
6. Apply for renewal on Form No. 3 within the three months before expiry (section 16(2), regulation 8). A late renewal means a new registration.

The officer must also file quarterly compliance reports with the Commission (regulation 32(c)). Government fees below are at 26 September 2026 from the Zatra fee register. The amount on the control number issued by the authority governs on the day of payment.

Category	Registration	Renewal (5 years)	Register ID
Small: 1 to 49 staff, revenue under TZS 100m	TZS 100,000	TZS 50,000	F0719, F0720
Medium: 50 to 99 staff, TZS 100m to 500m	TZS 200,000	TZS 150,000	F0719, F0720
Large: 100 or more staff, above TZS 500m	TZS 1,000,000	TZS 500,000	F0719, F0720
Non-commercial and religious bodies	TZS 100,000	TZS 50,000	F0721
Public institutions	TZS 100,000 to 500,000	TZS 50,000 to 300,000	F0721

Two points are not settled. The schedule and Form No. 1 word the large band differently (100 employees against more than 99). Neither the register nor the regulations says which band applies when staff numbers and revenue point to different bands. Ask the PDPC in writing. The register also holds no line for searching the public register, so confirm that fee with the PDPC.

Does the Act apply in Mainland Tanzania and Zanzibar?

Section 2 says the Act applies to Mainland Tanzania and to Zanzibar, but in Zanzibar it does not apply to non-union matters. A FB Attorneys note of 8 September 2025 and a Wolters Kluwer arbitration blog of 7 May 2025 read the clause the same way. Union matters are those listed in the Constitution's First Schedule, such as banking, currency and income tax.

Point	Mainland	Zanzibar
Statute	The Act applies in full	Applies to union matters only (section 2)
Own data law	Not needed	None found; drafting was reported in 2023
Register	PDPC register	Same register for union matters; rest to confirm
Safe course	Register before collecting	Register if you serve Mainland customers

A Daily News report of 19 July 2023 said Zanzibar's Law Reform Commission was preparing its own personal data law. We found no enacted Zanzibar statute, but that is unverified. Whether a Zanzibar-only site with a contact form falls outside the Act is unsettled in the sources we could read. A Zanzibar advocate should confirm it.

What must a privacy notice say?

Section 23(2) requires the controller to make sure the person knows the purpose of collection, that it is for authorised purposes, and who the intended recipients are. Regulation 23(a) adds that processing must be transparent, and regulation 26(a) requires a stated purpose for each activity. The law prescribes no template. The desk's checklist for a site notice is below. The first three items follow the statute. The rest are practice.

• Who the controller is, with address and the data protection officer's contact.
• What data each form, button and tool collects, and why.
• The ground you rely on for each flow.
• Who receives it: host, email tool, analytics, advisers, authorities.
• Whether it leaves Tanzania, and under what permit or safeguard.
• How long you keep it.
• How to ask for access, correction, erasure or a stop to marketing, and your reply time.
• How to complain to the PDPC.
• Your approach to children, and the date the notice was last updated.

NEMBO's own privacy notice follows this shape and states that Google Analytics runs only after a visitor accepts the banner. Zatra's guide to what the notice must say covers the legal wording. Put the link in the footer of every page and beside every form.

Which lawful basis fits a form, a chat button and a tracker?

The Act has no list of lawful bases like the European one. Section 22(2) requires a lawful purpose tied to a function of the controller. Regulation 25, as read, speaks of a legal basis or legitimate interest and asks that people understand what they consent to. Written consent is mandatory for sensitive personal data under section 30(1). That class includes data about children, offences and financial transactions.

The desk therefore records one working ground per flow: steps requested by the person, a legal duty, a legitimate business interest, or consent. This is practice, not a statutory menu. Zatra's note on consent, retention and transfer argues the same point. Two matters are unknown. First, whether the PDPC treats a cookie identifier as personal data under section 3(c), which covers any identifying number assigned to a person. Second, whether it expects opt-in consent for analytics. Consent first is the cautious design.

What must a consent banner do?

No provision requires a banner by name. A banner is the tool that lets a site meet transparency and consent evidence for trackers and newsletters. A form that only lets you answer an enquiry needs a notice, not a banner. A good banner has these features.

• Accept and Decline carry equal weight, and nothing optional loads before Accept.
• Withdrawal is as easy as giving consent, which regulation 25(d) expects and section 30(2) states for sensitive data.
• The choice is recorded with a date, so you can show it.
• The text links to the notice and names the tool.

For Google tags, Google's consent mode guide (updated 13 October 2026) lets a site set analytics storage to denied by default and update it after a choice. A GA4 property keeps event data for 2 or 14 months, according to Google's retention page. Pick the shorter period unless you can name a use for the longer one. The Core Web Vitals guide shows how to keep the banner from slowing the page.

When can personal data leave Tanzania?

Section 5(h) forbids transfers in breach of the Act. Sections 31 and 32 allow a transfer to a country with adequate protection, and to others on listed grounds, including the person's consent, contract performance, or Commission authorisation with safeguards. Regulations 20 to 22 set a permit route. The applicant files Form No. 7, shows one of three things (an international agreement, an agreement with Tanzania, or a contract with the recipient), and the Commission decides within fourteen days. A granted permit on Form No. 8 limits the data to the named recipient and purpose.

Unknown: whether the PDPC expects a permit for each software service whose servers sit abroad. Your analytics, email, chat and cloud tools probably do. Write down where each provider processes data, tell visitors in the notice, and ask the PDPC in writing which tools need a permit. Hosting in Tanzania reduces the question but does not remove it, because the other tools still send data out.

What must you do after a data breach?

Section 27(5) says the controller must notify the Commission without any undue delay of a security breach. The Act fixes no number of hours. Clyde & Co's note of 9 February 2026 says that neighbouring regimes read the phrase as 48 to 72 hours, but that figure is not in Tanzanian law. It also reports that the Commission prescribes a notification format and that the Act imposes no duty to tell the people affected.

Regulation 27(j) asks for procedures to detect, handle, report and learn from breaches. Section 27(4) requires a contract that makes each processor act on your instructions, so the processor should alert you at once. Write a one-page procedure: who decides, who writes to the PDPC, and where the time of discovery is logged. Telling affected people early is sound practice even where the Act does not require it.

How long can you keep data, and what can people ask for?

Section 5(e) limits storage to what is necessary. Section 28 ties retention to the periods in other laws or in regulations, and regulation 30 asks for deletion rules with justified periods. No fixed period exists for marketing lists, enquiries or analytics. Choose a period you can defend, state it in the notice, and delete on schedule.

Right	Where	Clock in the text
Access to own data	Section 33	None set in regulations
Stop harmful processing	Section 34, regulation 15	Suspend in 72 hours, decide in 7 days
Stop direct marketing	Section 35	None set
Correct data	Section 29, regulation 16	14 days
Erase data	Section 38, regulation 17	14 days
Compensation	Section 37	Claim against controller or processor

A reply promise of 30 days, as some privacy pages give, is not a figure in these regulations for correction or erasure. Complaints go to the Commission under GN 449B. Clyde & Co report, in a consent article republished in September 2025, that the Commission awarded TZS 20,000,000 in a complaint over personal data published without consent. A testimonial, staff photo or client logo on a site can raise the same issue.

What are the penalties?

The texts give several layers. Section 19 makes breaching Part III, or giving false information to the registry, an offence, and as read it is punished under section 63. Section 63 sets a fine of TZS 100,000 to 5,000,000, imprisonment up to five years, or both. Section 45 lets the Commission issue an enforcement notice giving at least 21 days to comply. Section 47 caps a penalty notice at TZS 100,000,000.

The heavy figures sit in section 60 on unlawful disclosure. An individual faces TZS 100,000 to 20,000,000, up to ten years, or both. A company faces TZS 1,000,000 to 5,000,000,000. Section 62 reaches officers who knowingly allow a company offence. Some press notices quote up to TZS 5 billion for non-registration. The text we read ties that ceiling to disclosure, not to the registration offence, so ask an advocate before quoting it. Zatra explains the exposure in its post on failing to register.

What does an investor or bank check on the site?

A reader doing two minutes of diligence looks for a Privacy link in the footer, a named controller with an address, and a form that says what happens to the data. Our guide on what an investor checks on a company website scores those items with the rest of the page. A registration certificate number adds a checkable fact, since the regulations provide for a public register.

We found no published bank or investor rule that makes a PDPC certificate a condition of a loan or a deal. That point is unverified. The data room checklist shows where the certificate and the notice belong if a counterparty asks. The desk does not decide or guarantee any authority's outcome, whether that authority is a bank, a tender panel or a regulator.

TCRA licensing of online content is a separate regime, with fee lines F0693 to F0696 in the register. Whether a plain business-information site needs one is not settled in our sources, so confirm with TCRA if you publish news or aggregated content.

Worked example: a Dar es Salaam consultancy site

Kisutu Advisory Limited is a fictional consultancy with eight staff and revenue of TZS 85,000,000. The figures are illustrative. Both tests place it in the small band: eight is within 1 to 49 staff, and TZS 85,000,000 is under TZS 100,000,000. Registration costs TZS 100,000 (F0719). Renewal in year five costs TZS 50,000 (F0720). Over two certificates the fees total TZS 100,000 + TZS 50,000 = TZS 150,000. Had revenue been TZS 180,000,000 with the same staff, the two tests would disagree, and the firm should ask the PDPC.

Data flow	Data	Working ground	Notice line
Contact form	Name, email, phone, message	Steps the person asked for	We use these details to reply and keep them for 12 months.
WhatsApp button	Number, messages	Steps the person asked for	Chats run on WhatsApp under its own terms, and we keep them 12 months.
Analytics	Visits, device, pages	Consent	With your consent we measure visits with Google Analytics for 14 months.
Newsletter	Email, name	Consent	We email you only if you tick the box, and you can stop at any time.
Host and email tool	All of the above	Processor contract	Our providers act on our written instructions and may store data abroad.

The firm appoints an officer, files Form No. 1, publishes the notice in the footer, and sets the banner to deny analytics until a visitor accepts. It writes to the PDPC about the foreign-hosted tools, and diaries renewal for month 57, three months before expiry.

What to do now

1. Map every data flow. List each form, chat button, newsletter, tracker, plug-in and vendor on the site, with the data each holds.
2. Decide controller or processor. Mark which flows you control and which you run for a client.
3. Appoint the officer. Name a person, internal or external, who can sign the quarterly reports.
4. Register with the PDPC. Prepare Form No. 1, your incorporation certificate or ID, and the fee for your band.
5. Publish the notice. Put it in the footer and beside each form, using the checklist above.
6. Fix the banner. Block optional tags until Accept, and make withdrawal one click.
7. Check transfers. Record where each provider stores data and write to the PDPC about permits.
8. Write the breach and rights procedures. Set owners, a log, and the 72-hour, 7-day and 14-day clocks.
9. Diary renewal and reports. Put the renewal window and the quarterly report dates in the compliance calendar.

Key dates

No statutory deadline now applies to a new business. The duty is to register before collecting data. The dates below come from the Act, the regulations and press reports.

Date	Event	Source
1 May 2023	Act dated in force	Act text
4 Jul 2023	GN 449C regulations	Regulations
31 Dec 2024	First registration deadline	Daily News
30 Apr 2025	Extended deadline	Daily News, 11 Jan 2025
8 Apr 2026	Final registration deadline	Daily News, The Chanzo
9 Apr 2026	Enforcement begins	Daily News, The Chanzo
Month 57 of a certificate	Renewal window opens	Regulation 8

What the NEMBO desk prepares

The client shares the facts: the tools on the site, the staff count, the revenue band, the processors and the retention periods. Zatra Consultants prepares and checks the content. NEMBO designs and delivers it.

The documents are the privacy notice and consent banner text for a website or a Build project, a data-flow register, a breach and rights procedure, and a data protection policy set within the controlled documents desk. The free checklists show how we present evidence, and the process page shows how a job runs. Government fees at the official rate are paid to the PDPC and are separate from NEMBO's and Zatra's fees. Those fees are published on packages and pricing and quoted in writing. Share the details to begin, or read the answers page first.

How Zatra helps

Zatra checks the facts the notice depends on: the legal name and address against the BRELA record, the band against staff and revenue, and each tool against the data it holds. It checks the form entries and the fee against the register line, and the dates against the certificate. It reads the draft for statements the law does not support. For the surrounding compliance work see Zatra's tax and regulatory compliance service.

The desk does not decide or guarantee any authority's outcome, whether that authority is a bank, a tender panel or a regulator. Disputes, prosecution and legal opinions go to an advocate. Tax and reporting questions go to an accountant.