Data privacy day and what it means for Tanzania

DAR ES SALAAM: FOR many people, privacy sounds vague and abstract. Something technical. Something for banks, big companies or people ‘with secrets.’ In everyday conversations, it is easy to hear phrases like this does not concern us or it is just a picture. Yet the truth is simpler and more unsettling.

Privacy concerns all of us because personal data is produced by ordinary living. Every call, photo, video, message, registration form and online interaction leaves a trail.

This reality came into sharp focus during the International Data Privacy Day 2026 Celebration on 28th January, organised by the Tanzania Privacy Professionals Association (TPPA) held at the University of Dar es Salaam’s Faculty of Law. I participated in the forum and what made it powerful was not just the law itself, but how the speakers walked us from lived experience into legal protection.

TPPA, plays a quiet but important role in Tanzania’s privacy space. It brings together privacy experts, journalist, Cyber Experts, academicians and policy stakeholders to build awareness and practical understanding of data protection in Tanzania. This privacy day celebration reflected that mission clearly.

The conversation began with Imani Luvanga, a multimedia journalist and digital rights advocate. Her session did something essential. It translated personal data from legal language into real life.

She showed how a simple photograph is not just an image. It can be used to generate AI-created videos, it can be turned into stickers, it can be edited, reshaped and circulated far beyond its original context. A short voice note is not just sound; it can be cloned.

A casual video can be repurposed in ways the person recorded had never imagined. This is where many of us in the room truly connected with the idea of personal data.

It stopped being a definition and became a mirror. We saw how easily everyday sharing our personal data can affect dignity, safety, reputation and control.

That session grounded everything that followed. Where the law steps in Once the audience understood what personal data really is, the conversation moved naturally to the law that governs it. Advocate Abdul Naumanga took the floor to explain Tanzania’s Personal Data Protection Act, 2022, which came into force on 1st May 2023. He explained that the Act exists to restore balance.

Individuals have rights over their data: The right to know why it is collected, the right to consent or refuse, the right to correct inaccurate data and the right to object to misuse. Institutions, on the other hand, must justify how they collect, store, use and retain personal data.

A key point emphasised was that handling personal data is no longer informal. The law requires data collectors and processors to register with the Personal Data Protection Commission (PDPC).

Registration certificates are valid for five years. Registered institutions are also required to appoint Data Protection Officers (DPOs) who are responsible for ensuring the protection of personal data, submitting quarterly compliance reports and upholding privacy obligations in the institution.

Privacy compliance is therefore an ongoing process, not a symbolic exercise.

Enforcement and remedies Understanding rights naturally leads to the next question: What happens when those rights are violated? This is where Adv Pascal Mshanga brought the law to life. He explained how enforcement works through the PDPC, which is situated in Dodoma and has authority across the country.

He walked the audience through real examples of how complaints are handled, how the Commission investigates and how it has begun to decide matters and award remedies to affected individuals. Importantly, he explained that awards issued by the Commission are enforceable as decrees of the High Court which gives the process real legal weight. A critical point emphasised was access.

A person does not need a lawyer to file a data protection complaint. Complaints can be filed online in the PDPC’s website or physically, in Swahili or English and individuals are free to represent themselves.

ALSO READ: THE COMPUTER IN YOUR POCKET: Mobile phone is now a personal digital computer

This makes the system accessible to ordinary people. At the same time, it was advised that having a legal practitioner can be helpful, especially where matters are complex or contested. Legal representation is not mandatory, but it can strengthen how a case is presented and argued.

He also clarified the 21-day rule. A person who becomes aware that their personal data has been misused has 21 days from the date of knowledge to act. Before filing a complaint, the law expects an individual to first notify the person or institution misusing their personal data and request that the misuse be stopped or corrected. If that request is refused or ignored, a formal complaint may then be lodged.

The enforcement process itself prioritises amicable resolution. Alternative dispute resolution can be attempted before a final determination is made. Only when settlement fails is the individual supposed to proceed to the Commission for a binding decision.

What made the seminar coherent was how each session built on the last. First, we understood what personal data really is and how easily it can be misused.

Then we learned how the law protects it. Finally, we saw how enforcement works in practice and how remedies are awarded. For someone previously unaware of data protection, this progression matters. It shows that privacy is not paranoia and data protection is not a foreign concept. It is about control, accountability and respect in the society. The Personal Data Protection Act is an active law.

TPPA’s work in convening these conversations, and the Commission’s role in enforcing the law, signal that privacy in Tanzania is no longer optional. Awareness is now the responsibility of all of us. Jua Leo, Jilinde Kesho is not just a slogan; it is a reminder that awareness is protection. When people know the law, they document violations, speak up early and use the systems available to them.

When institutions know their obligations, they act more carefully. This column is intended for general legal awareness only. It does not constitute legal advice. Legal outcomes depend on specific facts and circumstances, and individuals affected by data protection issues are advised to seek professional legal assistance.