Failing to Register with the PDPC: What It Actually Exposes You To

This page is the data-protection registration operating file: what an entity is exposed to while it stays off the Commission’s register, and how that gap is read by desks which never mention data protection by name. It is not a privacy-notice drafting kit and not a clause-by-clause summary of the Act.

• A name is not a legal person: business name registration
• The registry sequence beneath it: registering a company at BRELA
• What the registry does not ask for: is a business plan required
• Registration that confers less than people expect: copyright and COSOTA

As at 15 September 2026. The mandate-holder is the Personal Data Protection Commission (pdpc.go.tz); this file rests on the 2022 Act and the two sets of Regulations made under it in 2023, whose Government Notice numbers you read off that portal rather than from a summary.

One Commission, and it reaches both sides of the Union

The Commission sits in Dodoma under the ministry responsible for information and communication technology. It is not a unit of TCRA, not a department of the police, and not a certification body. Its function here is binary: an entity is listed or it is not, and the certificate is the only evidence of which.

Company law splits at the channel; this regime does not. The 2022 Act reaches Tanzania Zanzibar as well as the Mainland, so a Stone Town hotel and a Dar es Salaam lender apply to the same body even though one incorporates at BPRA and the other at BRELA under the Companies Act Cap. 212.

Controller, processor, and the exemption that is not there

A controller decides why and how personal data is handled. A processor does the handling on someone else’s instructions. Most operating companies are both (controller of staff and customer records, processor for at least one client) which means two descriptions of processing in one application, not two companies.

No headcount floor exists and no turnover threshold applies; the duty attaches to the activity. A guest house with a reservation book, a clinic, a payroll bureau, a school and a haulier holding driver biometrics are all inside it. So is a foreign-established processor handling data about people in Tanzania, which is why a Dubai holding layer moves nothing offshore.

Employee files are the usual blind spot. Payroll, the personal file kept under the Employment and Labour Relations Act Cap. 366, NSSF and WCF submissions, and the camera at the gate are all personal data. “We do not sell anything” has never been the test.

What the gap blocks, desk by desk

The trigger is a complaint, not a sweep

No inspectors walk Samora Avenue looking for unregistered processors. Files open when a person complains: a dismissed employee whose file circulated, a customer whose number reached a marketing list, a borrower whose default was mentioned to a relative. The Personal Data Protection (Complaints Settlement Procedures) Regulations, 2023 set the route, lodged with the Commission, the respondent written to, the matter determined.

Standing is the first line of that correspondence. A listed respondent argues about lawful basis, retention period and security measures. An unlisted one argues first about why it never applied, and every substantive answer is then heard against that backdrop. The second conversation is slower, and it leaves a trail the next bank officer or evaluation committee can ask about.

What the Act exposes you to, in structure

Three layers, and none substitutes for another. First, the Commission’s own enforcement: directions to comply, to suspend an operation, to correct or to erase. Second, offences under the Act tried in the ordinary courts, with officers of a body corporate exposed where the offence is traced to their consent or neglect. Third, a civil claim by the data subject, running on its own timetable whatever the regulator decides.

The amount attached to the second layer moves with amending legislation and is not reproduced here; read it off the statute on the day you need it. The shape does not move. An entity outside the register meets all three layers without the one document showing it took the regime seriously beforehand.

The exposure travels down your contracts

A registered controller must appoint processors on written terms and stays answerable for what they do with the data. That duty is passed on commercially, not politely. Processing agreements now carry a warranty of registration, a right to terminate if the certificate lapses, and an indemnity sized to the controller’s own risk.

The effect on an unregistered supplier owes nothing to any regulator writing to it. A bank will not appoint a card-data bureau that cannot show a certificate. A telco licensed under the Electronic and Postal Communications Act Cap. 306 will not appoint an unverified call centre. Transfers out carry their own conditions: payroll moved to a group server in Frankfurt is a transfer, and the safeguard belongs in the application, not in an email sent after a query lands.

The sequence, in the order the desks take it

1. Map the processing before opening a form. What data, about whom, for what purpose, held where, shared with whom, kept how long.
2. Settle controller, processor, or both. That answer changes what you describe and what your client contracts must say.
3. Fix the legal person first. One name across the registry extract, the TIN certificate and the licence.
4. Appoint the person answerable at an address that will receive the Commission’s letters.
5. File on the portal with the description of processing, the security statement and the transfer destinations, and pay the prescribed fee.
6. Put the certificate into the KYC pack held by the bank, the tender office and group compliance.
7. Paper the chain. Written terms with every processor and sub-processor, the offshore ones included.
8. Diarise renewal and re-file on change. A new product line or server location is a variation, not a footnote.

Documents the application actually needs

Certificate of incorporation with a current extract; TIN certificate and a business licence in the same name; memorandum and articles whose objects match the activity generating the data; a written description of processing covering categories of data, categories of data subjects, purposes and retention; the lawful basis for each purpose; a statement of technical and organisational security measures; destinations of any transfer abroad with the safeguard named; particulars of the person answerable; proof of payment.

A processor established outside the country adds its local representative. The description of processing is what takes weeks, because it forces a business to state what it has been doing with records it has held for years.

Illustrative arithmetic: what a late certificate costs a bidder

A payroll bureau bids for a twelve-month contract worth TZS 1,200,000,000 excluding VAT, or TZS 100,000,000 a month. The tender pack calls for the certificate. The bureau has none, and building the file then waiting for issue pushes the start by two months.

• Revenue deferred: 2 × TZS 100,000,000 = TZS 200,000,000
• Output VAT deferred at 18% under the Value Added Tax Act Cap. 148: TZS 36,000,000
• Service levy at 0.3% of that turnover under the Local Government Finance Act Cap. 290: TZS 600,000
• At a 15% net margin, chargeable profit of TZS 30,000,000 taxed at 30% under the Income Tax Act Cap. 332: TZS 9,000,000, shifted into a later year with the provisional instalments due on the last day of the third, sixth, ninth and twelfth months

Illustrative arithmetic, not a quotation. The application fee is trivial against those lines, which is the point: the cost of staying off the register is the delay, not the charge.

Where this file stalls

• Names that only almost match between incorporation papers and the portal account: almost is a rejection
• A foreign parent’s global privacy notice filed as the local description of processing
• Consent claimed for payroll, where the real basis is contract and statutory duty
• Registering the holding company while the subsidiary that touches the data stays outside
• Applying in the week the tender closes, then asking whether an acknowledgement will do

What moved since the Act commenced

The statute was passed in 2022 and made workable by two sets of Regulations in 2023: one on collection and processing, one on complaints. The Commission then ran registration windows, and deadlines for existing entities were extended more than once. Those grace periods have closed.

The practical change by 2026 is not a new section. It is that the certificate has become a routine line in bank onboarding, tender eligibility and cross-border processing agreements, so counterparties ask for it long before any regulator does.

What registration is not, and which desks keep their own files

A certificate is not a security certification, not permission to process whatever you like, and not an answer to a charge under the Cybercrimes Act No. 14 of 2015. It says you are listed with a stated description of processing. Depart from that description and the paper stops describing you.

Surrounding mandates stay where they are. BRELA and BPRA own corporate identity. TRA owns tax registration and clearance. The Bank of Tanzania owns banking confidentiality under the Banking and Financial Institutions Act Cap. 342. TCRA owns the communications overlay, and the Financial Intelligence Unit owns suspicious-transaction reporting under Cap. 423. No such desk accepts a data-protection certificate in place of its own paper, and a compensation claim or prosecution is an advocate’s file. Zatra prepares and coordinates the registration and the contract chain; it does not appear for a client, issue approvals or guarantee a decision.

What to confirm before you act

• The current form, fee schedule and validity period on pdpc.go.tz, and the Government Notice numbers behind the 2023 Regulations
• Whether each entity in the group processes in its own right, and therefore applies in its own name
• The lawful basis for every purpose, written down before the form is opened
• Every place the data physically sits, backups and a group server abroad included
• The live penalty provision as published by the Commission, read on the day you brief the board