Data protection and the media: A necessary alignment, not a threat

DAR ES SALAAM: OVER the past few weeks, I have been listening very carefully to the conversations happening within our media fraternity. Some of these conversations are cautious, others are skeptical, and a few are openly resistant. At the center of it all is the enforcement of the Personal Data Protection Act, Cap. 44 (PDPA).

The concern being raised is not unfamiliar: will this law interfere with journalism? Will it limit press freedom? Will it make it harder for us to do our work? These are valid concerns. But I believe they are also being asked from a place that deserves clarity, not assumption. Let me begin by stating something as clearly as possible.

The PDPA does not regulate journalism. It regulates how we handle personal data. It does not interfere with truth-seeking, with investigative reporting, or with the role of the media in holding power to account. What it introduces is not restriction, but discipline. And perhaps it is this discipline that feels unfamiliar.

The reality is that media institutions today are no longer just producers of news and entertainment. We have, quietly and without much reflection, become custodians of people’s personal data.

Every day, we collect phone numbers through call-in programs, manage WhatsApp groups for news alerts, run competitions that require personal details, and track audience behavior through our digital platforms.

This is not a small shift. It is a fundamental transformation of what the media does. The question we must ask ourselves, honestly, is not whether we handle personal data. We clearly do. The real question is whether we have been handling it responsibly. Take a simple example that many of us are familiar with.

A radio station runs a promotion and asks listeners to send their names and phone numbers via SMS or WhatsApp.

Thousands participate. Before this law, what happened to that data afterward was rarely questioned. It could be reused for promotions, shared informally, or even passed on to third parties without the participant ever knowing. It was normal practice.

But when you look at it from the listener’s perspective, it raises an important issue. Did they give you their number for that specific competition, or did they unknowingly give you access to their personal space beyond that purpose?

The PDPA now requires us to be clear about that. It requires us to collect data for a defined purpose and to respect that boundary.

What this creates is not inconvenience, but trust. And trust is what keeps audiences loyal. Now consider another scenario, one that goes to the heart of journalism itself. A journalist interviews a victim of a sensitive incident, perhaps a case of gender-based violence or a family dispute.

The story is important. It deserves to be told. But in telling it, the individual’s identity is revealed, their face is shown, their environment is recognizable. We must pause and ask: was that individual fully aware of the consequences?

Was their consent informed? Was their dignity protected beyond the immediate need of the story? The PDPA does not stop us from telling such stories. It asks us to handle the individuals within those stories with care, with respect, and with foresight. That is not a limitation to journalism. It is a strengthening of its ethics.

There is also a less visible, but equally critical area that we must confront. Many of our newsrooms today operate in ways that expose both the institution and the people we work with to unnecessary risk.

Sensitive information is often stored on personal devices, shared through unsecured platforms, or accessed without clear control. We handle whistleblower information, confidential sources, and private records, yet we do not always apply structured systems to protect them.

This is not just a compliance issue. It is a professional risk. One data breach, one leaked identity, one exposed source can damage not only an individual, but the credibility of the entire media institution and its Editors. The Personal Data Protection Act forces us to take this seriously.

ALSO READ: Police warn rogue bouncers over brutality

It pushes us to secure what we have long treated casually. Then there is the issue of digital media and advertising, an area many of us rely on for survival. Audience personal data has become a valuable asset. We track what people read, how long they stay, what interests them.

This data informs content and drives advertising revenue. But we must ask ourselves a difficult question: have we been transparent with our audiences about this?

Or have we quietly normalized data collection because it benefits us? The PDPA introduces a shift here. It requires consent. It requires clarity. It requires justification. At first glance, this may seem like a disruption to existing models. But in reality, it is an opportunity.

Because the future of media is not built on silent data extraction. It is built on informed and trusting audiences who choose to engage because they feel respected. Much of the resistance I hear is also framed around press freedom. But I believe this is where we must be most precise. Regulating personal data is not the same as regulating content.

The PDPA does not stop a journalist from investigating corruption, questioning authority, or reporting on matters of public interest. Those freedoms remain intact. What changes is how we treat the personal information connected to those stories.

As I always like to say, The coming of PDPA is not to change the Taurat of our proffessional. In fact, one could argue that this law strengthens journalism. When sources know their information will be handled securely, they are more willing to speak.

When audiences trust how their data is used, they engage more deeply. Credibility grows. And in today’s media landscape, credibility is everything.

So perhaps the real issue is not the law itself, but the adjustment it demands from us. It asks newsrooms to rethink their systems, to invest in better practices, and to build internal awareness. It asks journalists to be more conscious of the data they handle, not just the stories they tell. These are not restrictions.

They are professional upgrades. The global media industry is already moving in this direction. Personal data protection is becoming a standard expectation, not an exception. Tanzania is not being singled out. We are aligning with a global reality. And so, the question we must ask ourselves is not whether this law limits us. The question is whether we are ready to evolve.

As media practitioners, we have always demanded accountability from others. Governments, institutions, corporations, we expect them to act responsibly, transparently, and ethically.

The Personal Data Protection Act simply asks us to apply those same principles to ourselves, especially when we are entrusted with people’s personal information. This is not a threat to press freedom. It is a reinforcement of responsible freedom.

The coming of the PDPA is not here to rewrite the “Taurat” of journalism. It does not change who we are or what we stand for as media practitioners—truth, public interest, and holding power accountable remain exactly as they have always been. What it does, in a very practical sense, is challenge how we go about our work.

It is a reminder that in telling people’s stories, we are also handling their lives, their identities, and their dignity. So this is not about changing journalism; it is about practicing it with a deeper sense of responsibility, the same accountability we constantly demand from others.

Because the future of journalism in Tanzania will not only be defined by the stories we publish, but by how responsibly we handle personal data of the people behind those stories.