The Commission established under the PDPA is mandated to ensure the implementation and enforcement of the provisions of the PDPA. The Commission has investigative and corrective powers including to:

• receive, investigate and handle complaints related to alleged contraventions of personal data and privacy of persons; and
• investigate and take necessary steps against anything it considers affects the protection of personal data and infringes privacy of individuals.¹

The Commission is empowered to issue an enforcement notice on any person if satisfied that that such person has failed to comply with the provisions of the PDPA. Through this notice, the Commission will specify the provision of the Act which have been contravened, the steps which must be taken remedy or eliminate the infringement, the period within which such measures must be implemented (which cannot be less than 21 days), and any right to appeal.²

Where the person fails to comply with the enforcement notice and the Commission is satisfied to that effect, the Commission can issue a penalty notice requiring the person to pay fine to be specified in the notice. In determining whether to give a penalty notice and the fine payable, the Commission is required to consider the following:

1. the nature, gravity and duration of the infringement;
2. the intentional or negligent character of the infringement;
3. any measures taken by the data controller or processor to mitigate the damage or distress suffered by data subjects, including technical and administrative / organizational measures;
4. any previous infringements by the data controller or data processor;
5. the degree of co-operation with the Commission, in order to remedy the infringement and mitigate its possible adverse effects;
6. the categories of personal data affected by the infringement;
7. the manner in which the infringement became known to the Commission, including whether the data controller or processor notified the Commissioner of the  infringement;
8. the extent to which the data controller or processor had complied with previous enforcement or penalty notices;
9. adherence to approved codes of ethics or terms and conditions of registration;
10. whether a penalty would be effective; and
11. any other aggravating or mitigating factors applicable to the case, including financial benefits gained, or losses suffered, as a result of the infringement (whether directly or indirectly).

The maximum penalty which the Commission may issue in the enforcement notice is Tanzania Shillings One Hundred Million (TZS 100,000,000, approx. US$ 430,000).³

The Commission may also direct the controller or processor to pay the affected data subject compensation for infringement of the PDPA and there is no ceiling on the amount of compensation which the Commission can award.⁴

Disclosure of personal data without lawful excuse (including obtaining such data or offering such data for sale) is also a criminal offense which on conviction carries a fine and / or imprisonment. For individuals, the minimum fine for a violation is Tanzania Shillings One Hundred Thousand (TZS 100,000, approx. US$43) and the maximum is Tanzania Shillings Twenty Million (TZS 20,000,000, approx. US$ 8,600).

The maximum term an individual may be sentenced for violating a provision under the PDPA is ten (10) years. If found in violation of the PDPA, an individual may be required to both pay a fine and serve a sentence.⁵

For a company or corporation, the minimum fine for a violation is Tanzania Shillings One Million (TZS 1,000,000, approx. US$ 430) and the maximum is Tanzania Shillings Five Billion (TZS 5,000,000,000, approx. US$ 2,150,000).⁶