RIVE & CO is pleased to announce the publication of the definitive Tanzania – Third Country Assessment Guidance Note, 2025 Edition, authored by Partner Sunday Ndamugoba. This key resource is published by a global leader in data privacy intelligence and compliance.
The Guidance Note provides an essential, high-level overview of the legal and regulatory framework governing the transfer, collection, and processing of personal data in the United Republic of Tanzania. It serves as a critical guide for international organisations, data controllers, and processors conducting due diligence on compliance requirements and cross-border data flows into the jurisdiction.
Sunday Ndamugoba’s work offers in-depth analysis of the current legislative landscape, with a particular focus on the implementation and impact of the Personal Data Protection Act, 2022 (PDPA)
Key areas covered in the authoritative assessment include:
- Foundation of Privacy Rights: Confirmation of the principles of the rule of law and the constitutional safeguards for human rights, as enshrined in The Constitution of the United Republic of Tanzania and the Bill of Rights.
- The Data Protection Regime: Detailed examination of the PDPA’s objectives, which include regulating the collection and processing of personal information, establishing legal and institutional frameworks, and safeguarding individuals’ privacy.
- Supervisory Authority: Confirmation of the establishment of the Personal Data Protection Commission (PDPC) as the independent and impartial supervisory authority, including its functions and enforcement powers
- International Data Transfers: Analysis of the rules governing onward data transfers to third countries or international organisations under Sections 31 and 32 of the PDPA, which permit export based on an adequacy assessment of the recipient country’s data protection standards.
Landmark Case Law and Precedent
The 2025 Guidance Note incorporates the impact of recent and significant judicial and regulatory decisions, which establish crucial precedents for data controllers operating in Tanzania:
- Monetary Compensation: Analysis of the landmark ruling in Abdul Said Naumanga v. Mi Casa Company Limited, where the PDPC for the first time awarded TZS 20 million (approx. $8,171) in monetary compensation for a privacy violation, emphasizing the PDPC’s active enforcement role and the principle of ‘continued breach’6666.
- Constitutional Validity: Review of the 2024 High Court decision in Tito Elias Magoti and Another v. The Attorney General, which upheld most of the PDPA’s provisions while ordering the amendment of specific sections found to be vague7777.
Strategic Significance
“The regulatory landscape in Tanzania continues to mature rapidly, driven by the PDPA and active enforcement by the PDPC,” commented Sunday Ndamugoba. “This comprehensive assessment is an indispensable tool for our clients and the broader legal community, providing clarity on compliance obligations and the evolving standards of accountability required for data processing operations.”
About Sunday Ndamugoba and RIVE & CO
Sunday Ndamugoba is a Partner at RIVE & CO, a premier corporate and commercial law firm in Tanzania. With offices in Dar es Salaam, Zanzibar, Dodoma, and Arusha, RIVE & CO is positioned to offer strategic counsel across all major commercial and judicial centres. Sunday Ndamugoba’s specialization ensures clients receive expert advice on data privacy, cyber regulation, and digital compliance in a globalized legal environment.