Registration with the Personal Data Protection Commission is a continuing legal requirement, not a deadline that has passed. This note sets out who must register, where to register and what the process involves.
Who is required to register
Under the data protection regulations, entities acting as data collectors or processors are required to register with the Commission for Personal Data Protection. That includes any entity which collects, stores, processes or uses personal data in its operations.
Personal data means any information relating to an identified or identifiable natural person. It includes, among other things, names, addresses, identification numbers, contact information, financial data, medical records and biometric data.
Why almost every company is caught
On that definition it is clear that nearly all companies are required to register. Most employers collect personal data about their own employees, including names, addresses, contact details, financial data and mandatory medical records.
The same applies, on a larger scale, to companies handling customer information. Businesses in hospitality, including hotels, resorts and camps, together with real estate, healthcare, telecommunications, fintech, banking and other financial institutions, collect and process significant volumes of personal data and should register promptly.
Registration is now a continuing obligation
The voluntary grace period closed on 8 April 2026. Registration did not close with it. Registration is a continuing legal requirement under the Personal Data Protection Act, Cap. 44.
The Personal Data Protection Commission has stated that any unregistered institution currently collecting or processing personal data must complete registration immediately, to avoid ongoing enforcement penalties and audits. If you missed the grace period, the answer is to register now rather than to wait.
Where to register
Registration is entirely digital and is completed through the Commission's official portal at dataprotection.pdpc.go.tz.
How to register
- Appoint a Data Protection Officer. Designate one person in your company to act as the DPO.
- Prepare an introduction letter. Draft a formal corporate letter officially introducing your DPO.
- Create an account. On the PDPC portal, select the option to register your organisation.
- Verify the email. The DPO clicks the verification link sent to the account email address.
- Upload and pay. Log back in, upload the DPO introduction letter, submit your company's incorporation documents and pay the registration fees.
Register with the Personal Data Protection Commission
The official portal for registering as a data collector or processor in Tanzania.
Open the PDPC registration portalOur original client notice
The communication below was issued in April 2024, when the Commission first announced the registration requirement. Its description of who must register still holds. The six month period it refers to has since passed, and the current position is as set out above.
Important notice: registration of data collectors and processors
Our April 2024 client communication on the public notice, including who is required to register.
Open the PDFIf you have not yet registered, or you are unsure whether your processing activities are caught, we can confirm your position and guide you through the registration.