The recent public notice issued by the Personal Data Protection Commission (PDPC) mandating the blanket registration of all data controllers and processors by April 8, 2026, represents a significant deviation from global data protection best practices. While the operationalization of the Personal Data Protection Act (PDPA, Chapter 44) is a positive step toward securing digital rights in Tanzania, the blanket approach—coupled with disproportionate compliance requirements and contentious registration fees—risks undermining the very privacy rights it seeks to protect, while simultaneously stifling economic activity and civic space.
Risks to the Public
The directives outlined in the notice pose several serious dangers to citizens' privacy rights and socio-economic well-being:
- Surveillance Overreach and Chilling Effects: By explicitly requiring the registration and "quarterly compliance reports" of "civil society organizations, non-governmental organizations (NGOs)... media houses, political parties," the state establishes a mechanism that could easily be misused. Without strong safeguards for independence, compelling these entities to reveal their data processing systems to government oversight risks exposing journalistic sources, whistleblowers, and political dissidents to unnecessary surveillance.
- Exclusionary Economic Practices: The notice broadly targets "all industries," including small "cleaning companies" and "BnBs." Combined with the high, supposedly unfair registration fees currently challenged by local media, this creates a significant barrier to entry. Small businesses might be forced to shut down or operate in the informal, unregulated sector, ultimately depriving the public of accessible services and pushing employee and customer data into the shadows where no protection exists.
- Centralized Honeypot Creation: Requiring every entity to register and submit detailed structural and system data to a new government portal (RCMIS) creates a large, centralized database of infrastructure intelligence. If the PDPC's cybersecurity measures are not airtight, this registry could become a highly valuable target for malicious actors, ironically putting the very data subjects the commission seeks to protect at risk.
A core principle of modern data protection is the Principle of Proportionality. Regulatory burdens should be proportional to the risk to data subjects.
- Overreach Targets: The notice explicitly requires all institutions—including "guest houses," "cooperative societies," and "cleaning companies"—to appoint a Data Protection Officer (DPO), establish secure systems, and submit quarterly reports. This constitutes a significant regulatory overreach.
- Required Exemptions: Small-scale informal businesses, such as local vendors, independent tradespeople, freelance journalists, small community organizations, and micro-enterprises, should be exempt from mandatory registration and DPO appointment.
- Violation of Proportionality: A rural cooperative society processing basic membership lists presents virtually no systemic risk compared to a "mobile network operator." Imposing identical compliance burdens—including DPO salaries, system audits, and high registration fees—on both entities is inherently disproportionate and legally unjustifiable under global standards.
Tanzania’s current blanket approach sharply contrasts with established international and African frameworks, which universally favor a risk-based approach:
- Tiered Registration Thresholds (Kenya Model): Kenya’s Data Protection Regulations set clear thresholds; entities are generally exempt from mandatory registration if their annual turnover is below a certain threshold (e.g., KES 5 million) or if they process the data of fewer than 10,000 subjects, unless they process highly sensitive data.
- Public Interest and Journalistic Exemptions (GDPR/POPIA): The EU's GDPR and South Africa's POPIA explicitly provide strong exemptions for data processed for journalistic, literary, or artistic purposes to protect a free press. Tanzania's decision to include "media houses" without acknowledging these widely recognized exemptions is notably irregular.
- Targeted DPO Requirements (GDPR): Under GDPR (Article 37), appointing a DPO is mandatory only if the core activities involve "large-scale, regular and systematic monitoring" or large-scale processing of sensitive data. Requiring a DPO for every registered entity is practically impossible, given the current scarcity of certified privacy professionals in the region.
The March 26 notice must be withdrawn immediately and revised. Why?:
- Socio-Economic Threat via Unfair Taxation: Imposing mandatory registration fees on micro and small businesses, as well as nonprofits, functions as an arbitrary tax that endangers economic stability and civil society's survival, with no real connection to actual data privacy risks.
- Impossibility of Compliance (Timeline & Resource Restraints): Giving entities only a few days (until April 8, 2026) to appoint trained DPOs, establish secure IT systems, and draft compliance reports is both administratively and technically impossible. The resulting non-compliance will be systemic, making the threatened fines (up to TZS 5 billion for institutions) draconian and exploitative rather than corrective.
- Threat to Democratic Functions: Widespread requirement for media and political parties to submit mandatory, state-audited quarterly reports risks shrinking civic space and press freedom in the name of data protection.
The PDPC should implement a phased, risk-based compliance model. Phase 1 should focus solely on high-risk, high-volume data processors such as telecom companies, banks, and large hospitals. The Commission must also urgently begin public consultations with CSOs and the private sector to revise the fee structure and establish reasonable minimum thresholds for revenue and data subject volume, below which registration is not necessary.
Civil Society Mobilization: A Call to Action
To protect civic space and ensure that the law (PDPA) benefits the public rather than controls it, local NGOs, trade unions, and media organizations must act quickly.
- Organize Evidence-Based Awareness Campaigns: Translate these directives into economic realities. Publicly demonstrate how mandatory DPOs and exorbitant registration fees will force the closure of local cooperatives, small clinics, and community media. Highlight that privacy should not be a luxury tax.
- Demand Immediate Parliamentary Review: Petition the Parliamentary Committee responsible for ICT to urgently review the PDPC’s subsidiary regulations and fee structures. Demand the immediate introduction of registration thresholds and explicit exemptions for public interest journalism and small-scale operations.
- Utilize Regional Human Rights Bodies: If the PDPC moves forward with enforcement actions against civic and media groups, CSOs should prepare to escalate the issue. Draft briefs explaining how these regulations infringe on freedom of expression and association, using organizations such as the East African Court of Justice (EACJ) and the African Commission on Human and Peoples' Rights (ACHPR) to seek injunctions against excessive enforcement.