Your office moves, data protection remains

DAR ES SALAAM: FROM working at home to making mobile-money payments, safer digital habits protect our money, our work and the people who trust us.

A message arrives while you are working away from the office. It appears to come from your manager: a payment is urgent, the account details have changed and you must act immediately. You recognise the name. You are busy. You make the transfer. Only later do you discover that your manager sent no such instruction.

Digital fraud does not always begin with sophisticated technology. Sometimes, it begins with a familiar name, a believable story and a moment when urgency replaces verification. This October, Cybersecurity Awareness Month offers Tanzania an opportunity to examine how we protect ourselves in an increasingly connected society.

Our phones give us access to money, business records, photographs, conversations and essential services. Protecting them means protecting livelihoods, privacy and trust.

When work travels beyond the office

For people who work between offices, homes and other locations, flexibility brings additional responsibilities. A laptop may move from an office network to a home connection. A work document may be opened on a personal phone.

A customer’s information may be shared through an application the employer has never approved. Each situation raises a practical question: are our protections keeping pace with the way we actually work?

Weak passwords, outdated devices, insecure home routers and unauthorised applications can expose an organisation’s information.

So can sending a confidential document to the wrong recipient or following instructions in a fraudulent email. Employers therefore need clear, workable arrangements for remote access, approved devices, document sharing and incident reporting.

Employees need guidance they can understand and follow. A policy that exists only in a file offers little protection when someone must make a decision under pressure.

Mobile money: convenience that requires care Mobile-money services have made everyday transactions easier for Tanzanians.

They help families support one another, traders receive payments and businesses serve customers. Criminals exploit that convenience by impersonating service providers, inventing emergencies or claiming that money was sent to the wrong number.

Others promise prizes or ask users to disclose a PIN or verification code. The first defence is to pause. An urgent request is not proof of a genuine request. Before transferring money or changing payment details, verify the instruction through a contact number you already know.

Do not rely solely on the number or link supplied in the suspicious message. Never disclose your mobile-money PIN, password or one-time verification code to anyone claiming they need it to resolve a problem.

If you suspect fraud, contact your mobile-money provider or bank immediately through its official channels. Keep the messages, transaction references and other evidence. Prompt reporting gives the provider an opportunity to investigate and take protective action.

The Tanzania Communications Regulatory Authority (TCRA) also provides the free SMS channel 15040 for reporting suspected fraudulent phone numbers.

Users can dial \*106# to check SIM-registration information. These serve different purposes: one reports suspected fraud, while the other helps users check registration details.

ALSO READ: Vision 2050: Data protection defines Tanzania’s digital future

Public Wi-Fi: know what you are connecting to

A café, hotel or airport lounge can become a temporary workplace. A convenient connection, however, deserves the same care as the information passing through it.

In a warning reported by HabariLeo in July 2025, Mr Innocent Mungy, then Head of Public Relations and Communication at the Personal Data Protection Commission (PDPC), cautioned users about the risks associated with free public Wi-Fi and the exposure of sensitive information.

One risk is a fake hotspot designed to resemble a legitimate network. Another is a deceptive login page asking for information that the venue does not need.

Confirm the network name with venue staff. Treat unexpected requests to install software or provide sensitive credentials as warning signs. It is equally important to undestand encryption. A properly secured HTTPS connection protects information travelling between your device and a website.

However, HTTPS does not guarantee that the website itself is trustworthy. A fraudulent site can encrypt information you willingly submit to it.

For sensitive work, use your organisation’s approved connection method. Where practical, a personal mobile-data connection can help you avoid an unfamiliar public hotspot.

Any virtual private network (VPN) used for work should be approved by the employer and used in accordance with applicable Tanzanian requirements.

Handling personal data carries responsibility

Cybersecurity and privacy are closely connected, but they address different questions. Cybersecurity protects systems and information against threats.

Privacy also concerns whether personal information should be collected, how it is used, who receives it and how long it is retained.

Tanzania’s Personal Data Protection Act, 2022, provides the legal framework for personal-data protection. Organisations should understand the registration and compliance obligations that apply to their activities. Remote working brings these responsibilities into everyday decisions.

Where are customer records stored? Who can access them? Are employees using approved cloud services? Does an overseas service provider receive personal information? The PDPC operates a permit framework for transfers of personal data outside Tanzania.

Organisations should assess their arrangements and meet the applicable requirements before making such transfers. Protecting data requires attention throughout its use, from collection and storage to sharing and disposal.

Make protection part of everyday work Organisations should provide approved tools, keep systems updated, restrict access according to job responsibilities and maintain secure backups.

Staff also need regular, practical guidance on recognising suspicious messages and reporting mistakes promptly. For individual users, a few habits make a difference:

– Use strong, unique passwords and enable multi-factor authentication where available.

– Keep phones, computers, browsers and applications updated.

– Verify unexpected payment requests through a trusted, separate channel.

– Use approved tools for confidential work and avoid sharing sensitive documents through unauthorised applications.

– Secure your home router and replace default administrator credentials.

– Lock your device when stepping away and report suspected compromise promptly.

Leaders have a responsibility to provide the tools, time and support that make safe behaviour possible. Employees should feel able to report an honest mistake promptly.

Fear of blame can delay the response and allow the damage to spread.

Trust must travel with the technology

Tanzania’s digital future depends on people having confidence in the services they use and the institutions handling their information.

That confidence grows when organisations protect customer records, providers respond quickly to fraud reports and users know how to recognise and challenge suspicious requests.

Our workplace may move from an office to a home, a hotel or a roadside stop.

Our responsibility to protect information moves with it. This October, begin with the next message, the next payment and the next document you share.

Pause. Verify. Protect. Someone’s money, privacy or trust may depend on that moment.