CCTV, privacy and the cost of misunderstanding the law

IN the past few days, I have followed carefully and with a sense of professional responsibility the public conversation that emerged after my presentation at the TBC Washitiri Meeting in Arusha.

What began as a straightforward reminder on compliance with the Personal Data Protection Act, Cap. 44 (PDPA), has, in some quarters, been distorted into a narrative that risks creating unnecessary fear among citizens.

Let me begin with clarity. At no point did I state that every individual who owns a CCTV camera must register with the Personal Data Protection Commission (PDPC).

What I emphasized firmly and deliberately is thatNany institution, public or private, that collects and processes personal data has a legal obligation to register.

This is not my opinion. It is a requirement grounded in PDPA, Cap.44 reinforced by the directive issued by the Minister, Angellah Jasmine Mbelwa Kairuki, setting 8th April 2026 as the deadline for voluntary registration. What concerns me is not just the misreporting, but what it reveals.

1. We Still Underestimate What “Personal Data” Means In discussions that followed, I noticed a recurring pattern: many people still associate personal data with only “formal” identifiers such as names, ID numbers, or phone contacts. Yet in reality, personal data is far broader and more embedded in our daily lives.

A patient walking into a private laboratory in Kiboriloni Moshi, leaves behind blood samples.

A caller contributing to a radio show in Shinyanga shares their voice and sometimes their location. A camera mounted outside a shop in Kariakoo captures faces, movements, and behaviors.

All of this is personal data. CCTV footage, in particular, is often misunderstood because it feels passive.

But it is not. It continuously records identifiable individuals, often without them actively engaging with the system. That makes it powerful and legally sensitive.

2. The Line Between Household Use and Institutional Responsibility One of the most important distinctions under the PDPA, Cap 44 is the context of data processing.

If a homeowner installs a CCTV camera strictly for personal, domestic security, say, monitoring their gate in Kwa Maangulwa Mkuu Rombo, that falls within a different category than a business, a media house, or a public institution systematically collecting and storing footage.

However, the moment data collection becomes structured, continuous, and tied to an activity beyond purely personal use, the legal obligations shift. This is where confusion has been most visible.

The law does not seek to burden ordinary citizens. It seeks to regulate systems that process personal data at scale or in structured environments: banks, hospitals, broadcasters, telecom operators, and yes, organizations operating CCTV systems for business or institutional purposes.

3. Visibility as a Deterrent, Not Just a Legal Requirement There is a practical dimension to CCTV that is often overlooked: transparency itself is a form of security.

Under the PDPA, Cap 44, individuals and institutions using CCTV are required to inform people that they are under surveillance, typically through clear and visible signage. Many interpret this as a procedural obligation. It is more than that.

A visible notice does two things simultaneously: it respects privacy rights, and it discourages wrongdoing. People with bad intentions are less likely to act when they are aware they are being recorded.

In that sense, signage is not weakening security, it is strengthening it. I recall a conversation with a mother who had installed CCTV in her home to monitor how her house help treated her baby.

Her instinct was to keep the cameras hidden, to “catch” any wrongdoing. I asked her a direct question: Is it better to secretly record abuse and discover it after harm (death) has occurred or to make the presence of cameras known and prevent that harm altogether? The answer reframes the purpose of surveillance.

CCTV should not only be about evidence after the fact. It should be about prevention. A house help who is aware of surveillance is far less likely to mistreat a child. Transparency, in this case, protects life, not just data.

4. Boundaries Matter: Your Security Must Not Violate Others Another critical issue that emerged is how CCTV cameras are positioned.

Even in domestic settings, the use of cameras must respect the privacy of others. Cameras should be directed strictly within one’s premises.

Recording a neighbor’s compound, a shared pathway, or sections of a public street introduces legal and ethical complications.

The principle is simple: your right to security does not extend into someone else’s right to privacy. Improper placement of cameras can inadvertently turn a lawful security measure into unlawful surveillance.

Individuals must take responsibility to ensure their systems are confined to their own property and purpose.

ALSO READ: PDPC: CCTV use without registration illegal

5. Media Content: The Overlooked Risk Area At the Washitiri Meeting, my emphasis was equally on content production. Producers, presenters, and editors often handle personal data without labeling it as such. A street interview in Mwenge.

A reality segment filmed in a market. A televised hospital feature showing patients in recovery. These are not just “stories.”

They involve real people whose dignity, consent, and privacy must be respected. There is a tendency to assume that once something is broadcast, it becomes public property.

That is a dangerous assumption. The law requires that personal data—even when used for storytelling must be handled responsibly, lawfully, and with clear purpose.

6. The Responsibility to Inform Not Alarm The role of the media is critical here. Accurate reporting is not optional when dealing with legal frameworks.

A headline suggesting that “everyone with CCTV must register” does more than misinform, it creates panic, erodes trust, and distracts from the real objective: compliance by those who are actually required to comply. Public understanding of data protection is still developing in Tanzania. This means every misinterpretation carries amplified consequences.

7. What This Moment Has Taught Us This episode has been instructive.

First, it confirms that public education on data protection must go deeper and become more practical. Legal awareness cannot remain abstract, it must connect to everyday realities.

Second, it highlights the need for precision in communication, especially when dealing with regulatory matters.

Third, and perhaps most importantly, it shows that Tanzanians are paying attention. The level of engagement, even where misdirected, signals growing awareness. That is a positive foundation to build on.

A Practical Call to Action Going forward, the path is straightforward:

• Institutions: If you collect or process personal data, whether through forms, digital systems, media content, or CCTV, ensure you are registered with PDPC before the deadline.

• Media practitioners: Treat every image, voice, and story involving individuals as personal data. Apply editorial judgment alongside legal awareness.

• Individuals with CCTV at home or business premises: Install clear signage indicating surveillance. Position cameras responsibly so they capture only your premises. Use CCTV as a deterrent not a trap.

• The public: Ask questions. Understand your rights. Demand accountability where your data is concerned. This is not about restriction.

It is about responsibility. The PDPA, Cap 44 is not an obstacle, it is an enabler of trust in a rapidly digitizing society.

And trust, once lost, is far more difficult to rebuild than it is to protect. As we approach the 8th April deadline, the focus should not be on fear but on clarity, compliance, and collective responsibility.

That is how we build a society that respects both innovation and dignity. Think criticaly and be objective. Privacy is critical to personal diginity and safety.