By Our analyst
In an increasingly digital economy, personal data has become an important resource for business, investment, and service delivery. However, its value comes with a responsibility to protect individual privacy and citizens' rights.
Effective personal data protection builds trust in the use of technology, reduces the risk of information misuse and contributes to an environment conducive to business and investment.
Recognising this importance, the Government of the United Republic of Tanzania, under the leadership of President Samia Suluhu Hassan, enacted the Personal Data Protection Act, Chapter 44 (PDPA), in 2022. The legislation, passed by Parliament, paved the way for the establishment of the Personal Data Protection Commission (PDPC) on May 1, 2023.
These developments created the legal and institutional foundation for regulating the collection, processing, storage and use of personal data across both public and private sectors.
At the official launch of the PDPC on April 3, 2024, President Samia emphasised that privacy is an integral part of human dignity and called on all institutions collecting and processing personal data to register with the Commission and comply with the law.
Her directive underscored the importance of institutional accountability and the protection of citizens' rights alongside technological advancement in the digital environment.
The Ministry of Communication and Information Technology has continued to oversee the implementation of relevant policies and legislation.
Speaking at the conclusion of training for Data Protection Officers (DPOs) in Arusha on January 5, 2026, the minister responsible for the ministry, Angellah Jasmine Mbelwa Kairuki, emphasised the importance of institutional registration with the PDPC and establishing secure systems for managing personal information.
Under the leadership of Director General Emmanuel Lameck Mkilia, the PDPC has continued to raise public awareness, register data controllers and processors, handle complaints and monitor compliance with the law.
Addressing DPO training in Mbeya on February 11, 2026, Mkilia warned that failure to observe the principles governing the collection and processing of personal data could threaten citizens' privacy, security and rights.
To strengthen enforcement, the Commission announced the commencement of mandatory compliance inspections on August 28, 2026.
By October 2026, more than 15,000 institutions had registered with the Commission, while over 445 complaints had been received and handled. The PDPC had also issued 121 permits for the transfer of personal data outside Tanzania.
These figures reflect progress in strengthening regulatory oversight, institutional accountability and monitoring of personal data processing across the country.
The relationship between personal data protection and investment is rooted in the need for investors to have confidence in data security, compliance with legal requirements and the ability of institutions to protect customers' rights.
A clear legal framework for personal data protection can strengthen confidence among businesses that rely on digital services and the exchange of information across national borders.
In this regard, implementation of the PDPA forms part of the broader regulatory environment that supports business operations and investment, although it is not the only factor determining investment levels.
According to Tanzania's investment performance report for 2021–2025, released by the Tanzania Investment and Special Economic Zones Authority (TISEZA) on January 7, 2026, registered investment projects increased from 252, valued at $3.7 billion in 2021, to 915 projects worth $10.95 billion in 2025.
The reported value of investment reached $9.3 billion in 2024.
These figures demonstrate investment growth during a period in which Tanzania has also strengthened its digital and legal frameworks, including the regulation of personal data protection.
While several factors influence investment decisions, a reliable regulatory framework that promotes data security and protects consumer rights can contribute to a more predictable business environment.
For the benefits of the data protection framework to be sustained, institutions must take practical steps to ensure compliance with the law.
These include registering with the Commission where required, establishing appropriate technical and administrative safeguards, providing transparent information about how personal data is used, and addressing citizens' rights and complaints.
Data Protection Officers play a central role in this process. They coordinate compliance activities, advise institutional management and monitor the collection and processing of personal information within their respective organisations.
Citizens also have a responsibility to understand their rights and exercise caution when sharing personal information, particularly when accessing online services.
Working with stakeholders, the PDPC will continue strengthening public awareness, inspections, complaints management and monitoring of compliance with the law.
These efforts are essential to building a trusted digital economy that protects human dignity and individual privacy while supporting a secure and predictable environment for investment in Tanzania.