PDPC registration and the Tanzanian privacy notice

Two files, one Act

The Personal Data Protection Act 2022 and the 2023 Regulations sit behind two operator questions that this site used to answer on two near-identical pages: who must register, and what the public notice must say. They are one compliance file. Registration is the filing on RCMIS. The notice is what you show the people whose data you process. Doing one and skipping the other is how a copied GDPR policy sits on a website while RCMIS stays empty.

This page is Mainland-first orientation. Zanzibar company, tax and licensing systems are not BRELA/TRA photocopies. Confirm the jurisdiction of the legal person and the premises before you treat a Mainland filing as finished.

Who must register

If your company is a data controller or a data processor under the Act (you decide the purposes, or you process on someone else’s instructions) PDPC registration is the instrument to open. A BRELA extract is identity. It is not PDPC registration. A TCRA licence or a cybersecurity product is not PDPC registration either.

Foreign companies that serve Tanzanian customers can still fall in scope. Do not assume “we have no Tanzania office” ends the file. Confirm the live PDPC guidance for extra-territorial processing; this page does not invent a threshold.

Decide controller versus processor on the facts of the processing, not on the job title on a business card. The sibling orientation is controller or processor. Then open RCMIS with the names, TIN and activity that match the company that actually processes the data.

What the Tanzanian privacy notice has to do

The notice has to describe the processing you actually do, not a European template with the city name swapped. At minimum it should make plain: what personal data you collect, why, the lawful basis you rely on, how long you keep it, who you share it with, and how a person complains to PDPC. If you transfer data outside Tanzania, say so and point at the live transfer rule, not at an EU adequacy story.

A notice that claims rights the Act does not give, or that omits the PDPC complaint route, is a document that will be read against the live law. Confirm the current PDPC notice expectations on the day you publish. This page does not publish a clause library or a fee.

Sequence that does not invent a calendar

1. Name the processing: whose data, for what, on which systems, in which jurisdiction.
2. Classify the role: controller, processor, or both on different activities.
3. Open RCMIS: register on the live PDPC portal. Keep the acknowledgement. Confirm fields on the day you file.
4. Write the notice against that file: same names, same purposes, same retention story.
5. Calendar the next duty: renewal, change of processing, or a complaint route. Confirm the date on the portal. Do not invent one.

Documents the file usually needs

• Company extract and TIN that match the people who will sign
• A plain-language description of the processing (not an object-clause poem)
• The live RCMIS form or procedure card
• The draft notice you will actually publish, not an EU template

Use the PDPC registration decision tool to separate controller/processor and to list notice clauses. The tool is orientation. The portal is the filing.

Where this file stalls

• Publishing an EU policy and never opening RCMIS
• Treating BRELA incorporation, a TCRA licence or a firewall as PDPC registration
• A notice that describes a different company than the one on the register
• Inventing a fee, deadline or section number from a law-firm alert

What this page does not cover

It is not legal advice, a fee table, or a TCRA/cybersecurity product. Penalty figures for GN No. 198 of 2025 or GN No. 487A of 2025 are not published here. Confirm reserved-activity questions on the live list before you assume a foreign-owned processor may operate as written.