Dodoma β The Personal Data Protection Commission (PDPC) has issued a final ultimatum to all public and private institutions to register their data collection and processing activities by April 8, 2026.
Speaking at a press conference in Dodoma on March 26, 2026, PDPC Director General Dr Emmanuel Lameck Mkilia announced that full enforcement of the Personal Data Protection Act, Chapter 44, will commence on April 9, 2026.
Institutions that fail to comply with the mandatory registration requirement will face severe legal consequences, including fines of up to Sh5 billion.
The directive targets a wide array of sectors that handle personal information, encompassing government ministries, agencies, and local authorities.
It also applies to the financial sector, including banks, insurance companies, and microfinance institutions, as well as educational and healthcare facilities.
Telecommunications companies, internet service providers, e-commerce platforms, and data centres are similarly required to register before the deadline.
Furthermore, the mandate extends to manufacturing industries, transport operators, tourism companies, legal and accounting firms, media outlets, political parties, and religious organisations.
READ MORE: Data Protection Watchdog Mandates Registration for Surveillance Cameras
Dr Mkilia emphasised that the government has provided ample time for institutions to prepare since the initial voluntary registration period began.
The preparation phase included an initial eight-month window granted by President Samia Suluhu Hassan to allow both public and private entities to register by December 31, 2024.
This deadline was subsequently extended to April 30, 2025, to facilitate comprehensive public education campaigns regarding the new data protection requirements.
A final extension was later announced by the Minister for Information, Communication and Information Technology, Angellah Jasmine Mbelwa Kairuki, establishing the definitive deadline of April 8, 2026.
These successive extensions were designed to ensure that all relevant organisations had sufficient opportunity to align their operations with the legal framework.
The impending enforcement phase carries substantial penalties for non-compliance under Sections 60, 61, and 62 of the Personal Data Protection Act.
Individuals found violating the law may face fines ranging from Sh100,000 to Sh20 million, imprisonment for up to 10 years, or both.
READ MORE:Ndugulile: Privacy and Data Protection Law Is ComingΒ
For corporate entities and institutions, the financial penalties are significantly steeper, ranging from Sh1 million to Sh5 billion, depending on the severity of the infraction.
Critical milestone
The implementation of these strict measures marks a critical milestone in the nationβs efforts to safeguard citizensβ fundamental right to privacy.
By regulating the collection and processing of personal data, the commission aims to prevent unauthorised disclosure and misuse of sensitive information.
This regulatory framework is also expected to bolster trust between service providers and consumers, which is considered vital for the expansion of the digital economy.
The law requires data controllers and processors to obtain informed and voluntary consent from individuals before collecting or processing their personal data.
It also mandates that organisations clearly communicate how the collected data will be utilised and who will have access to it.
Personal data under the legislation includes any identifying information, such as names, addresses, medical records, and financial histories.
READ MORE: What Happens When Your Personal Data Is Used for Malicious Motives?
The law places even stricter controls on sensitive personal data, which encompasses genetic information, biometric data, and details regarding religious or political affiliations.
Organisations are strictly prohibited from sharing personal data with third parties without the data subjectβs explicit consent.
Additionally, the legislation ensures that individuals have the right to withdraw their consent at any time without facing any charges or requiring complex explanations.
Global standards
The establishment of the PDPC and the enforcement of the Personal Data Protection Act align the nation with global data privacy standards.
As digital platforms and social media continue to expand rapidly, the risks associated with unauthorised data collection have grown exponentially.
The new legal framework provides a necessary safeguard against these modern vulnerabilities, ensuring that technological advancement does not compromise individual privacy.
READ MORE: Manara Accuses Simba SC Chairman Dewji of Phone Spying
With the deadline rapidly approaching, institutions across all sectors are urged to expedite their registration processes to avoid the impending legal repercussions.
The PDPC has reiterated its commitment to rigorous enforcement, signalling an end to the leniency that characterised the preparatory phase.
As April 9 draws near, the focus will shift from public awareness and voluntary compliance to active monitoring and penalisation of defaulting entities.
