| Personal Data Protection Act, 2022Act No. 11 of 2022 · regulator: Personal Data Protection Commission (PDPC) | In force · enforcedIn force 1 May 202318. PDPC fully operational from 3 Apr 202419. Registration deadline 8 Apr 2026, full enforcement from 9 Apr 202622. | Every controller and processor registers with the PDPC; registration lasts five years. A data protection officer is required. Breaches are reported to the PDPC promptly; no fixed hour limit is stated19. Processors tell the controller without undue delay21. Administrative fines reach TZS 100M. Criminal fines for companies run from TZS 1M to TZS 5B19. Sources differ on the fine for not registering: TZS 100,000–5M18 or up to TZS 5B22. | Implication: as a processor, XcellHost must register before processing Tanzanian personal data, and so must each customer.
Response: register early, and use vDPO and GRC services to run customer registrations, DPO duties and quarterly reports. |
| PDPA cross-border transfersSs. 31–32 PDPA · reg. 20, Personal Data Collection and Processing Regulations 2023 | In forceRegulations issued 12 May 202318. Clyde & Co cite them as GN No. 449C of 2023; FB Attorneys as GN No. 349 of 202320. | Transfers need adequate protection or a listed exception, such as consent or contract performance. A PDPC permit is required, naming the recipient and purpose, with evidence such as a contract with the recipient. Onward transfer needs fresh approval20. | Implication: Mumbai processing of Tanzanian personal data needs a permit for each arrangement.
Response: keep customer data in a Tanzanian partner DC by default. Apply for permits only for support access, with a contract that limits purpose. |
| PDPC guidance on CCTVAnnounced 25 Mar 2026 | Being enforcedRegistration before 8 Apr 2026, with inspections from April23. | Institutions and businesses that record people on surveillance systems must register, post clear notices and keep cameras to their own premises23. | Implication: hotels, banks, hospitals and retailers have a new registration and evidence task.
Response: bundle CCTV and privacy-notice reviews into PDPA readiness assessments. |
| Cybercrimes Act, 2015Applies to Mainland Tanzania and Zanzibar | In forceSince 201527. | Criminalises illegal access, interception, data espionage, computer-related fraud and forgery, and other offences. Sets search, seizure, preservation and disclosure powers. Hosting and caching providers have no general monitoring duty but follow take-down procedures27. | Implication: hosting contracts need lawful-request and take-down procedures.
Response: a law-enforcement request runbook and evidence-grade logging from Vortex SOC and DFIR. |
| National Cybersecurity Strategy 2022–2027Policy, not a statute | PolicyRuns to 2027. Commentators say it needs more resources and powers14. | Sets national cyber priorities. The same commentary notes no dedicated AI law and calls the PDPA not yet fully enforced, as of Aug 202614. | Response: track the successor strategy due after 2027 and align training offers to it. |
| BoT Cloud Computing Guidelines for Financial Service Providers, 2025Under s.71 Banking and Financial Institutions Act 2006 and s.56(3) National Payment Systems Act 2015 | IssuedReported 26 Aug 2025. Replaces the 2023 guidelines. Existing cloud users had 12 months to apply for approval or exit24. | Mission-critical systems, such as core banking, payments and essential databases, may not be hosted outside Tanzania. Other systems need prior written BoT approval. Contracts must be written and approved. A five-year cost-benefit analysis, a cloud policy and annual provider reviews are required. Applies to banks, mobile-money operators and microfinance institutions24. | Implication: regulated finance needs in-country hosting and a provider that supports BoT approval files.
Response: BFSI Cloud in a Tanzanian partner DC, plus an approval pack: due diligence, exit plan and cost-benefit template. |
| BoT Cybersecurity Guidelines for Financial Service Providers, 2026Draft, March 2026 | DraftPublished as a draft for comment. No effective date announced as of Apr 20262526. | Board accountability, a CISO and a cyber steering committee. MFA for privileged, remote and customer access. Quarterly vulnerability scans; annual pen tests by a TCRA-licensed firm. Central logs into a SIEM; a key-lifecycle policy. Significant attacks reported to the BoT within 24 hours via TZ-FINCERT. Annual awareness training25. | Implication: a ready-made checklist for every bank and mobile-money operator.
Response: managed SIEM/SOC, MFA, Cloud HSM and training. Pen tests delivered with a TCRA-licensed local partner. |
| Financial consumer data rulesNPS Act 2015 · BoT (Financial Consumer Protection) Regulations 2019 | In forceAs summarised by DLA Piper, Mar 202619. | Financial providers may not share consumer data with third parties, including for marketing, without prior written consent19. | Response: processor-only terms, with no secondary use of customer data, in every BFSI contract. |
| Electronic Transactions Act, 2015 + certification regulationsElectronic Transactions (Certification) Regulations 2025, GN No. 133 | In forceAct since 201528. TCRA publishes the 2025 certification regulations29; we could not open the text. | Electronic and secure electronic signatures are legally valid, and electronic records are admissible. Cryptographic and certification services must be licensed, and the regulator keeps a register. E-commerce consumer rules cover disclosure, cancellation and refunds28. | Implication: XcellHost is not a licensed Tanzanian certification service provider.
Response: partner with a licensed provider for secure signatures. Lead with private CA, CLM and PQC services. |
| National AI policyMinistry of Education, Science and Technology | DraftAt draft stage on 21 May 2026, with a pledge to fast-track. AI guidelines were presented in 202534. | No binding AI law yet. Stated goals: ethical AI, youth and institutional skills, and Kiswahili language models. A national Kiswahili AI model, led by the ICT Commission, was announced on 30 Apr 2026434. | Implication: buyers want governance before a law arrives.
Response: vCAIO advisory, ISO/IEC 42001 and AI literacy training, with PDPA-compliant data handling. |
| e-Government Act, 2019Creates the e-Government Authority (e-GA) | In forceSince 201931. | e-GA coordinates and enforces ICT standards for public institutions. Institutions must use government-approved communication infrastructure, and the Act mandates an e-Government Security Operations Centre31. More than 200 government systems exchange data over a central backbone32. | Implication: public bodies buy within e-GA standards and approved infrastructure.
Response: sell only through local primes and approved hosting such as NIDC, with skills transfer rather than outsourcing. |
| EPOCA 2010 and TCRA licensingElectronic and Postal Communications Act | In forceTCRA had licensed 146 application-service providers by Sep 202436. | TCRA licenses electronic communications systems and services30. National network facilities or services licences need at least 25% Tanzanian shareholding through a public offer; content licences need 51%35. Xalam reports that since Jul 2023 Tanzanian companies must host primary servers in Tanzania6; we could not trace the instrument. | Implication: whether cloud and managed-security services need a TCRA licence must be confirmed with counsel.
Response: deliver through licensed partners until counsel confirms, and plan in-country primary hosting. |
| Entity & taxCompany · CIT · VAT · digital services tax · withholding tax | CurrentAs summarised by PwC (reviewed 9 Sep 2026)373839. | Generally, a company can be wholly foreign-owned35. CIT 30%39. VAT 18% on the Mainland; 15% in Zanzibar, but 18% there for telecoms, banking and digital services. Non-resident electronic-service suppliers pay a 3% tax on turnover37. 15% withholding on service fees to non-residents; PwC lists 0% for management and technical fees under the India treaty38. | Response: see pricing & tax. Get Tanzanian tax advice for each contract structure. |