Personal Data Protection in Tanzania: Legal Challenges and Enforcement Prospects in the Digital Era

Abstract

The rapid digital transformation of Tanzania’s economy has significantly expanded the collection and processing of personal data across both public and private sectors, increasing the urgency for effective data-protection mechanisms. The enactment of the Personal Data Protection Act (PDPA) 2023 represents a landmark development in Tanzania’s legal landscape, affirming privacy as both a constitutional and human right within the digital environment. However, despite this legislative milestone, the Act’s implementation remains constrained by vague statutory provisions, overlapping institutional mandates, weak regulatory capacity, and limited public awareness. This article employs a doctrinal and comparative legal analysis to evaluate the effectiveness of Tanzania’s data-protection framework. It situates the PDPA within broader regional and international contexts, comparing it with the European Union’s General Data Protection Regulation (GDPR), the African Union’s Malabo Convention, and Kenya’s Data Protection Act 2019. The analysis reveals that while Tanzania’s PDPA incorporates globally recognised principles of lawfulness, fairness, and accountability, its enforcement potential is undermined by institutional fragility and inadequate legislative harmonisation. The study concludes that the success of the PDPA depends on the operational independence and resource capacity of the Personal Data Protection Commission (PDPC), greater inter-agency coordination, and a culture of compliance among data controllers and processors. It recommends targeted reforms emphasising legal clarity, institutional strengthening, technological innovation, and regional cooperation to align Tanzania’s data-protection regime with international best practices and to promote public trust in the digital economy.