Tanzania: technology regulation at a glance

Framework: No dedicated crypto statute; partial governance through Finance Act 2024 (digital-asset withholding tax, effective 1 July 2024), Anti-Money Laundering Act Cap. 423 (as amended through 2025) covering VASPs, Bank of Tanzania 2019 public caution notice, and High Court Commercial Case No. 12171 of 2024 (Yellow Card precedent). Primary oversight bodies: Bank of Tanzania (BoT) and Capital Markets and Securities Authority (CMSA).

Tanzania lacks a dedicated virtual-asset regulatory framework but has taken incremental steps toward one. The Finance Act 2024 (effective 1 July 2024) imposed a 3% withholding tax on digital-asset exchange payments and formally defined digital assets in statute for the first time. The Bank of Tanzania's 2019 public notice cautioned against crypto use and it remains non-legal-tender, yet a landmark December 2024 High Court ruling (Yellow Card case) established that cryptocurrency transactions are not illegal and crypto contracts are enforceable. Virtual assets have also been incorporated into Tanzania's AML/CFT framework without creating a dedicated VASP licensing regime.

Framework: MICIT Guidelines for AI Ethical Use (2025); Tanzania Digital Economy Strategic Framework 2024-2034; National AI Readiness Assessment (UNESCO/MICIT, 2025)

Tanzania has no binding AI-specific legislation in force. The Ministry of Communication and Information Technology (MICIT) published voluntary AI Ethical Use Guidelines in 2025, and sectoral guidelines exist for education and health. A National AI Readiness Assessment was completed with UNESCO support in 2025 and a National AI Strategy is under development but had not been formally adopted as of mid-2026.

Framework: Personal Data Protection Act No. 11 of 2022 (PDPA), enforced by the Personal Data Protection Commission (PDPC), with subsidiary regulations issued in 2023

Tanzania enacted the Personal Data Protection Act No. 11 of 2022, which came into force on 1 May 2023, establishing a comprehensive, sector-spanning data protection regime grounded in Article 16 of the Constitution. The Personal Data Protection Commission (PDPC) was formally inaugurated in April 2024 as the independent supervisory authority. As of early 2026, the Government issued a final enforcement ultimatum requiring all unregistered data controllers and processors to register within three months or face full legal penalties.

Framework: National Payment Systems Act, 2015, administered by the Bank of Tanzania (BoT), supported by the Payment Systems (Licensing and Approval) Regulations and the Payment Systems (Electronic Money) Regulations, 2015

Tanzania has a dedicated, in-force licensing regime for payments and e-money under the National Payment Systems Act, 2015, with the Bank of Tanzania as the sole regulator. Section 6 of the Act prohibits operating a payment system or providing payment services without a BoT licence (for non-banks) or approval (for banks/financial institutions), and e-money issuers must hold a licence and maintain a trust account. The framework is operational and increasingly mature, anchored by the interoperable Tanzania Instant Payment System (TIPS) launched in 2024.

Framework: Immigration Act (Cap. 54), administered by the Tanzania Immigration Department (immigration.go.tz) and work permits via the Prime Minister's Office e-permit portal (epermit.kazi.go.tz)

Tanzania has no dedicated digital nomad or remote-work visa as of May 2026. Remote workers typically enter on an Ordinary (tourist) visa valid for up to 90 days; longer-term stays must be regularised through a Residence Permit (Class A for investors/self-employed, Class B for employer-sponsored professionals, or Class C for other categories). Working for foreign clients while on a tourist visa is a legal grey area; Tanzania tightened permit-compliance enforcement in 2025.

Framework: Electronic and Postal Communications Act 2010 (Cap 306) + Electronic and Postal Communications (Online Content) Regulations 2020 (as amended 2025) + Cybercrimes Act 2015, enforced by the Tanzania Communications Regulatory Authority (TCRA)

Tanzania operates one of the most restrictive internet regimes in sub-Saharan Africa, combining mandatory TCRA licensing of all online content providers, broad prohibited-content rules, mandatory ISP and platform takedowns within two hours, and criminal sanctions under the Cybercrimes Act for false or 'misleading' information. The state exercises this framework aggressively: in 2025 alone authorities shut down over 80,000 websites and social media accounts, blocked the popular discussion platform JamiiForums for 90 days, and imposed a five-day nationwide internet blackout during the October 2025 general election, drawing condemnation from UN human-rights experts and the African Commission on Human and Peoples' Rights.

Framework: Cybercrimes Act No. 14 of 2015; Electronic and Postal Communications Act No. 3 of 2010 and CERT Regulations 2018 (amended 2023); Personal Data Protection Act No. 11 of 2022, enforced by TCRA/TZ-CERT and the Personal Data Protection Commission (PDPC)

Tanzania governs cybersecurity through a layered set of sector-specific instruments rather than a single comprehensive law: the Cybercrimes Act 2015 criminalises offences and imposes service-provider reporting duties; the Electronic and Postal Communications Act 2010 and its CERT Regulations (last amended August 2023) establish TZ-CERT and regulate ISPs and cybersecurity-service providers; and the Personal Data Protection Act 2022 (in force May 2023) mandates timely breach notification to the PDPC. A Government Cybersecurity Strategy 2022-2027 and a National Cybersecurity Strategy 2023-2028 provide the overarching policy framework.

Framework: Tanzania Investment Act 2022 (Act No. 14 of 2022); Companies Act (Cap. 212 R.E. 2002); Business Licensing (Prohibition of Business Activities for Non-Citizens) Order G.N. No. 487A of 2025; administered by TISEZA (Tanzania Investment and Special Economic Zones Authority, operational 1 July 2025)

Foreign nationals can incorporate a private limited company in Tanzania through BRELA's online system in roughly 2-3 weeks, with no minimum share capital required under the Companies Act itself. However, accessing investment protections and incentives requires USD 500,000 minimum capital registered with TISEZA (the authority that replaced TIC and EPZA from 1 July 2025). A July 2025 government order additionally bars non-citizens from 15 business categories including general retail, mobile money, and tour guiding.