Data protection regulator begins compliance crackdown

Dodoma. The Personal Data Protection Commission (PDPC) will begin on-site compliance inspections of institutions that collect and process personal data from Monday, August 31, 2026, following gaps identified during preliminary assessments.

PDPC Director General Dr Emmanuel Mkilia said on Friday that the inspections would assess compliance with the requirements of the Personal Data Protection Act, Cap 44, and enable the Commission to take appropriate action against institutions found to have violated the law.

Speaking to journalists in Dodoma, Dr Mkilia said the Commission initially conducted assessments using its systems and identified several areas that needed improvement.

The challenges included limited understanding among some data collectors and processors of their legal obligations, inaccurate information submitted during registration and difficulties in implementing data subjects’ rights.

Some institutions were also found to be transferring personal data outside the country without following procedures and requirements stipulated by law.

“These are some of the issues identified during the preliminary stage and they provide the basis for moving to the next phase of compliance inspections,” Dr Mkilia said.

He said the inspections would cover verification of institutions’ registration status, the performance of Data Protection Officers (DPOs), and how personal data is collected, processed and stored.

The Commission will also assess measures taken to protect personal data against loss, damage and unauthorised use, as well as procedures governing the transfer of personal data outside Tanzania.

Dr Mkilia said institutions found to be in breach of the law would face measures depending on the nature and severity of the violation.

These could include directives to rectify identified shortcomings, warning letters and fines imposed in accordance with the law.

“The aim is not to hinder the growth of the digital economy, but to ensure that this development takes place in a safe environment while protecting the rights of data subjects,” he said.

He urged data collectors and processors to ensure they are registered with the Commission, comply with the law and its regulations, have approved personal data protection policies and obtain consent from data subjects where legally required.

“From August 31, 2026, the Commission will officially enter the workplaces of data collectors and processors to begin compliance inspections,” Dr Mkilia said.