Tanzania’s data protection law and your marketing
Since the Personal Data Protection Act, 2022 came into force, the names, phone numbers and emails in your customer list are personal data with rules attached. Here is what that means day to day. This is a plain-language overview, not legal advice.
6 min read · Updated · KijaniHub
What counts as personal data
Anything that identifies a person: a name, phone or WhatsApp number, email address, photo, or a note about a customer. A business’s general phone line on its Google listing is less sensitive than a private number, but treat both with care.
The habits that matter most
- Have a reason: contact a business about something relevant to it — not random numbers.
- Say who you are in every message.
- Collect only what you need, and keep it safe (passwords, two-step sign-in, no shared spreadsheets on public links).
- Stop when asked, and keep a record so nobody in your team writes again.
- Answer people who ask what you hold about them, or ask you to delete it.
The Personal Data Protection Commission
The Act set up the Personal Data Protection Commission (PDPC), which handles complaints and registers organisations that collect or process personal data. Check the Commission’s own guidance on whether your business needs to register.
When you use software
If a tool stores your customer list, it processes data for you. Choose tools that keep each customer’s data separate, let you export and delete it, honour opt-outs automatically and say clearly where data is stored. KijaniHub’s Privacy Policy lists exactly that, including every provider it uses.
Questions
Is cold outreach to businesses allowed in Tanzania?
Contacting a business about something relevant to it, saying who you are and stopping when asked is the careful approach. Rules can differ for private individuals and for other countries, so check with a lawyer for your case.