Is Tanzanian Privacy Law Adequate For Regulating Artificial Intelligence

Author: LawSphereX

Category: Constitutional & Human Rights

Published: 2026-08-23T20:24:07.716685+00:00

Updated: 2026-08-30T07:08:10.330Z

IS TANZANIAN PRIVACY LAW ADEQUATE FOR

REGULATING ARTIFICIAL INTELLIGENCE?

Albert Moshi, Tanzania Institute of Accountancy, P.O. Box 9522, Dar es Salaam, Tanzania

ABSTRACT

In the era of the Fourth Industrial Revolution, characterized by the widespread adoption of artificial intelligence (AI) technology, the importance of privacy laws cannot be overstated. As AI technologies increasingly rely on vast amounts of personal data to function effectively, effective privacy protections are essential to safeguard individuals' rights to privacy. Privacy law plays a critical role in ensuring that personal data are collected, processed, and stored responsibly. However, AI technologies rely on vast amount of data collected from different sources and processed in realtime at unprecedented speeds. This reliance presents significant challenges in meeting the compliance requirements of existing privacy law. These technological advancements often outpace the development of legal frameworks intended to regulate their usage.

Thus, this study aimed to examine the adequacy of Tanzanian privacy law in regulating artificial intelligence technology. The key legal authority examined in this study is the Personal Data Protection Act no. 11 of 2022. The study revealed the compliance challenges of AI with the Personal Data Protection Act, especially in relation to Sections 4 and 8. Section 4 mandates that personal data must be collected for specified, legitimate purposes and not processed further in incompatible ways. However, AI technologies often rely on vast datasets for training and machine learning, leading to ambiguous compliance with this principle due to the unpredictable nature of AI applications which can lead to unforeseen uses of personal data.

The study also highlighted the challenges associated with Section 8 of the Act, which mandates obtaining informed consent from data subjects prior to the collection and use of their personal data. This becomes problematic in AI usage where data are extracted from multiple sources at high speed, making it difficult for individuals to fully understand and consent to all potential uses of their personal data. The study concluded that there is a disconnect between requirements of privacy law and real-world practices of AI, particularly regarding Sections 4 and 8 of the Act, and recommended the establishment of AI-specific privacy regulations tailored to address the unique challenges posed by AI technologies. Keywords: Artificial intelligence, Data Protection Act no. 11 of 2022.

1.0 Background

Globally, the Fourth Industrial Revolution, characterized by the emergence of artificial intelligence (AI), has brought privacy laws to the forefront of public discourse. The rise of artificial intelligence (AI) has intensified the need for comprehensive privacy laws to safeguard personal data in an increasingly digital and automated world. 1The right to privacy has been explicitly outlined as a fundamental human right in Universal Declaration of Human Rights (UDHR), adopted by the United Nations General Assembly in 1948, stressing its importance in protecting individual dignity and autonomy2. The emergence of computers and the internet has revolutionized how we communicate and access information, raising significant concerns about the right to privacy3.

Several countries around the world have implemented measures to protect the right to privacy, recognizing its significance in the digital age. In the United Kingdom, the Data Protection Act,4 is a key piece of legislation governing data privacy. This act incorporates provisions from the General Data Protection Regulation (GDPR), a comprehensive data protection law enacted by the European Union in May 20185. Together, these regulations established a strong framework for protecting personal data and ensuring individuals' privacy rights are upheld. In the United States, privacy protection is more fragmented, with various laws at both federal and state levels6. A notable example is the California Consumer Privacy Act (CCPA), enacted in 2018, which enhances privacy rights for California residents.

Additionally, the Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, protects the privacy of individuals' medical records and health information. In South Africa, the Protection of Personal Information Act (POPIA) was enacted in 2013, establishing comprehensive regulations for the processing of personal data. In Tanzania, the emergence of computers and the internet has significantly transformed various

1 Joshi, N. (2024). Emerging Challenges in Privacy Protection with Advancements in Artificial

Intelligence. International Journal of Law and Policy, 2(4), 55-77.

2 Musasa, T. (2023). An Analysis of the 1948 Universal Declaration of Human Rights (UDHR) on Gender

Inclusivity. The Fountain: Journal of Interdisciplinary Studies, 7(1), 187-206. 3 Chugh, U. (2023). The Evolution of Privacy Laws in the Digital Age: Challenges and Solutions. Indian Journal of Law, 1(1), 51-60.

4 2018

5 Bharti, S. S. , & Aryal, S. K. (2023). The right to privacy and an implication of the EU General Data Protection Regulation (GDPR) in Europe: Challenges to the companies. Journal of Contemporary European Studies, 31(4), 1391-1402. 6 Bakare, S. S. , Adeniyi, A. O. , Akpuokwe, C. U. , & Eneh, N. E. (2024). Data privacy laws and compliance: a comparative review of the EU GDPR and USA regulations. Computer Science & IT Research Journal, 5(3), 528-543. aspects of daily life, including communication, commerce, and information access7. The rise of computer technology and advancements in telecommunications within the country have introduced significant challenges to protection of rights to privacy8.

Historically, Tanzania began integrating computers into both government and private sectors in the early 1990s, a process that gained momentum following the government’s economic reforms and modernization efforts. By 1994, the adoption of computer technology had become widespread, with various government departments and private enterprises leveraging this technology to enhance efficiency and service delivery9. However, this rapid computer technological progress often outpaces the establishment of appropriate legal frameworks. This is evident in the fact that, despite the clear need for regulations, essential laws governing the use of computers and digital technologies were not enacted until 2015.

These legislations include Cybercrimes Act,10 which addresses issues related to unauthorized access to data and computer systems, Electronic Transactions Act of 2015,11 which lays down the legal groundwork for digital communications and transactions and more recently, the Personal Data Protection Act12 which was enacted specifically to safeguard individuals' personal data and privacy rights. This delay highlights a common phenomenon where legal framework and authorities lag behind computer technological innovations, resulting in legal lacunae in their regulation. As we enter the Fourth Industrial Revolution, characterized by the emergence of artificial intelligence (AI), the unique characteristics and applications of AI pose significant challenges to existing privacy law.

AI technologies are often defined by their reliance on massive amounts of data, characterized by high volume, velocity, variety, and veracity13. This multifaceted nature of AI complicates compliance with requirement of privacy law in Tanzania. If the regulatory framework is not properly examined and adapted, there is a significant danger that Tanzania may miss out on the benefits of AI innovations. Moreover, inadequate regulations could lead to legal disputes and litigations as individuals and organizations integrate their tasks and business processes with AI 7 Ndulu, B. , Stuart, E. , Dercon, S. , & Knaack, P. (2023). Driving Digital Transformation: Lessons from Seven Developing Countries (p. 241). Oxford University Press. 8 Yanamala, A. K. Y. , Suryadevara, S. , & Kalli, V. D. R. (2024). Balancing Innovation and Privacy: The Intersection of Data Protection and Artificial Intelligence.

International Journal of Machine Learning Research in Cybersecurity and Artificial Intelligence, 15(1), 1-43. 9 Kipingu, M. K. , & Shayo, D. P. (2021). Technology and immigration system: A new paradigm for improving government service delivery in Tanzania. PanAfrican Journal of Governance and Development (PJGD), 2(2), 81-106. 10No. 14 of 2015. 11No. 14 of 2015

12 No.11 of 2022.

13 Aldoseri, A., Al-Khalifa, K. N., & Hamouda, A. M. (2023). Re-thinking data strategy and integration for artificial intelligence: concepts, opportunities, and challenges. Applied Sciences, 13(12), 7082. technology. Therefore, this study aimed to examine adequacy of privacy law in regulating AI technology in Tanzania.

2.0 Legal Framework

Governing Privacy in Tanzania The legal framework governing privacy in Tanzania is primarily anchored in the Personal Data Protection Act no.11 of 2022 which establishes comprehensive measures to safeguard personal data and uphold individuals' privacy rights. The objectives of the Act14 as outlined in Section

3 of the Act includes to promote the protection of personal data and ensure that personal data

is processed in a manner that respects privacy rights. The word privacy is defined in Section

2 as "the right of an individual to keep their personal information and data confidential." This

definition emphasizes the importance of safeguarding individuals' personal data and ensuring that their information is handled in a manner that respects their confidentiality and autonomy. In addition, the word personal data is defined under section 2 of the Act15 as "any information relating to an identified or identifiable natural person. " This includes a wide range of information that can be used to identify an individual, either directly or indirectly. Examples of personal data encompass names, identification numbers, location data, online identifiers, and any other information specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual. This broad definition reflects the Act's commitment to protecting various forms of personal information in an increasingly digital world.

Moreover, the word data processing is defined under section 2 of the Act16 as "any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction of personal data. " This comprehensive definition encompasses a wide range of activities involved in handling personal data, emphasizing the various ways in which personal information can be processed throughout its lifecycle. Personal data must be processed in accordance with the principles outlined in Section

4 of the Act.17 This section stipulates that personal data should be processed lawfully, fairly,

14 Personal Data Protection Act no.11 of 2022

15 Personal Data Protection Act no.11 of 2022

16 Personal Data Protection Act no.11 of 2022

17 Personal Data Protection Act no.11 of 2022

and transparently, ensuring compliance with legal standards and respect for individuals' rights. Additionally, data must be collected for specified, legitimate purposes and not used in ways incompatible with those purposes. It further mandates that the data collected be adequate, relevant, and limited to what is necessary for its intended use, while also requiring that personal data be accurate and kept up to date. Moreover, personal data must be stored only for as long as necessary for the purposes for which it was processed and must be protected against unauthorized access, loss, or destruction. These principles collectively ensure that personal data is handled responsibly and ethically by obtaining consent of the data subject.

The term consent is defined under Section 2 of the Act18 as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of personal data relating to them, either by a statement or by a clear affirmative action. " Consent for processing personal data is governed by Section 8 of the Act. 19 . This section stipulates that consent must be informed, meaning that data subjects must receive clear information regarding the processing of personal data, including the purpose and any potential risks involved. Additionally, consent should be freely given, allowing individuals to make an informed choice without coercion or undue pressure. It must also be specific, relating to particular processing activities rather than serving as blanket consent for multiple uses.

Importantly, individuals have the right to withdraw their consent at any time, and this withdrawal process should be as straightforward as giving consent in the first place. These requirements collectively ensure that consent is meaningful and that individuals maintain control over their personal data. In addition to the Personal Data Protection Act,20 several other legal authorities, such as the Cybercrimes Act,21 Electronic Transactions Act of 2015,22 and Telecommunications Act,23 complement this main legislation by enhancing the overall framework for data protection and privacy in Tanzania. The Cybercrimes Act,24 addresses issues related to unauthorized access to data and computer systems, establishing penalties for cyber offenses. By providing a legal framework to combat cyber threats and protect personal information from breaches and misuse,

18 Personal Data Protection Act no.11 of 2022

19 Personal Data Protection Act no.11 of 2022

20 No.11 of 2022.

21 No.14 of 2015.

22 Cap 442 {R.E 2022}.

23 (2003).

24 No.14 of 2015.

this Act reinforces the safeguards outlined in the Personal Data Protection Act. It ensures that personal data is not only collected and processed lawfully but also protected against cyber risks that could compromise individuals' privacy. The Electronic Transactions Act of 2015,25 facilitates the use of electronic communications and transactions, recognizing the validity of digital signatures and contracts. This Act supports the Personal Data Protection Act by providing a legal basis for electronic interactions, which are increasingly vital in the context of data processing. It ensures that personal data shared in digital transactions is handled with the same level of protection as traditional data, thereby enhancing the overall security and integrity of personal information in electronic environments.

Similarly, the Telecommunications Act,26 regulates the telecommunications sector and mandates that service providers protect the confidentiality of communications and personal information. By establishing requirements for the privacy of communications transmitted over telecommunication networks, this Act complements the Personal Data Protection Act by ensuring that personal data remains secure during transmission, an essential aspect of protecting individuals' privacy in an interconnected digital landscape. Together, these laws create a cohesive framework that not only governs the collection and processing of personal data but also addresses the broader cybersecurity on digital transactions, and communication privacy, thereby strengthening the overall protection of personal data in Tanzania.

3.0 Implication Artificial Intelligence on Tanzanian Privacy Law

The reliance of AI technology on massive amounts of data extracted from multiple sources and processed at high speeds presents significant challenges for compliance with the requirements of Sections 4 and 8 of the Act.27 Artificial intelligence (AI) technology relies heavily on the four big data analytics characteristics which includes volume, velocity, variety, and veracity, which collectively shape its functionality.28 Volume refers to the enormous amounts of data generated from various sources, such as user interactions, websites, social media platforms, transactions, and sensors.29 Velocity highlights the speed at which data is created and

25 Cap 442 {R.E 2022}.

26 (2003).

27 Personal Data Protection Act no.11 of 2022

28 Aldoseri, A. , Al-Khalifa, K. N. , & Hamouda, A. M. (2023). Re-thinking data strategy and integration for artificial intelligence: concepts, opportunities, and challenges. Applied Sciences, 13(12), 7082. 29 Eleimat, D. , Ebbini, M. , Aryan, L. , & Al-Hawary, S. (2023). The effect of big data on financial reporting quality. International Journal of Data and Network Science, 7(4), 1775-1780. processed. 30 Variety encompasses the diverse types of data that AI systems can utilize, including structured data and unstructured data. 31 Lastly, veracity pertains to the accuracy and reliability of the data being processed. 32 While these characteristics enable AI technologies to drive innovation across various sectors, they also present compliance challenges with the Personal Data Protection Act.

33 The key provisions challenged by AI technology under the Act34 is Section 4 and section 8 which outlines the principles of data processing and consent requirement respectively. Section

4 establishes several principles of data processing, each of which faces unique challenges in

the context of artificial intelligence (AI). The first principle focuses on lawfulness, fairness, and transparency in processing personal data as stipulated under Section 4(a) of the Act35. This section is challenged by the often-opaque nature of machine learning algorithms that drive the functioning of AI technology. These algorithms are very complex and individuals cannot understand the internal algorithmic processing of their personal data making it difficult for individuals to understand the fairness and legality of the processing. Moreover, the principle of purpose limitation under Section 4(b) of the Act,36 encounters difficulties as AI technologies frequently utilizes large datasets for multiple purposes, often extending beyond the original intent for which the data was collected, leading to ambiguities in compliance.

In addition, data minimization principle as stipulated under Section 4(c) of the Act,37 is also challenging, as AI systems typically require vast amounts of data to function effectively, resulting in the collection of excessive information that contradicts the principle that data should be adequate, relevant, and limited. Furthermore, the principle of accuracy as stated in section 4(d) of Act,38 is challenged by the dynamic nature of AI, which can lead to inaccuracies, particularly when AI are trained on biased or incomplete datasets, undermining the maintenance of up-to-date personal data. Also 30 Trivedi, N. K. , Tiwari, R. G. , Jain, A. K. , Sharma, V. , & Gautam, V. (2023, August). Impact analysis of integrating AI, IoT, Big Data, and Blockchain Technologies: A comprehensive study. In 2023 3rd Asian Conference on Innovation in Technology (ASIANCON) (pp. 1-6). IEEE. 31 Aldoseri, A.

, Al-Khalifa, K. N. , & Hamouda, A. M. (2023). Re-thinking data strategy and integration for artificial intelligence: concepts, opportunities, and challenges. Applied Sciences, 13(12), 7082. 32 Aldoseri, A. , Al-Khalifa, K. N. , & Hamouda, A. M. (2023). Re-thinking data strategy and integration for artificial intelligence: concepts, opportunities, and challenges. Applied Sciences, 13(12), 7082.

33 No.11 of 2022.

34 Personal Data Protection Act no.11 of 2022

35 The Personal Data Protection Act, No.11 of 2022.

36 The Personal Data Protection Act, No.11 of 2022.

the principle of storage limitation as provided under Section 4(e) of the Act,39 conflicts with the need for AI systems to have continuous access to historical data for training and improvement, raising concerns about data retention beyond necessary periods. Lastly, the principle of integrity and confidentiality under Section 4(f) of the Act40, faces challenges as the vast volume and rapid processing capabilities of AI increase the risk of data breaches and unauthorized access, complicating the security of personal data. Together, these challenges highlight the complexities AI introduces in adhering to the foundational principles of data processing outlined in the Act. This shows As AI technologies rapidly evolve and increasingly rely on vast amounts of personal data, compliance with section 4 becomes more complex and often impractical.

Another key provision challenged by AI technology is Section 8 of the Act,41 which requires obtaining informed consent from data subjects. This section states that consent must be "freely given, specific, informed and unambiguous," indicating that individuals should fully understand and agree to how their data will be used. In AI situations, where data is frequently extracted from multiple sources and processed at very high speed, ensuring that individuals are fully informed about and consent to all potential uses of their data becomes increasingly challenging. The speed at which personal data is collected and processed poses significant challenges to the practicality of obtaining consent from individuals as AI technology always gather and analyze vast amounts of information in real-time, often within milliseconds42.

This rapid speed of processing data makes it difficult for organizations to ensure that individuals are fully informed about how their data will be used before consent is obtained leaving users with a limited understanding of how their data is being utilized.

4.0 Conclusion

The evident lacunae between the requirements of privacy laws and real-world practices in artificial intelligence (AI) pose significant implications for its implementation, particularly concerning Section 4 and Section 8 of Act43 .The principles outlined in Section 4 are often weakened by the nature of AI technology with their reliance on vast datasets for multiple

39 The Personal Data Protection Act, No.11 of 2022.

40 The Personal Data Protection Act, No.11 of 2022.

41 The Personal Data Protection Act, No.11 of 2022.

42 Villegas-Ch, W., García-Ortiz, J., & Sánchez-Viteri, S. (2024). Towards Intelligent Monitoring in IoT: AI Applications for Real-Time Analysis and Prediction. IEEE Access.

43 The Personal Data Protection Act, No.11 of 2022

purposes, leading to challenges in compliance. Similarly, the necessity for informed consent stipulated in Section 8 becomes increasingly impractical in an AI-driven technology as data are collected and processed at very high-speed making informed consent challenging to implement.44 The disconnect between the requirements of privacy laws and the real-world practices in artificial intelligence (AI) highlights an urgent need for AI regulation framework that effectively safeguard the right to privacy while simultaneously promoting the use of AI.

4.1 Recommendations

To the Government It is recommended that the government to establish National AI Strategy that include clear objectives and guidelines for ethical AI development and usage. This strategy should emphasize AI adoption across public and private sectors, ensuring transparency, accountability, fairness and protection of individual privacy in AI development and usage To Policymakers It is recommended that Policymakers should work towards developing AI-specific privacy regulations tailored to address the unique challenges posed by AI technologies. This framework can serve as a guideline for developers and users of AI, ensuring ethical practices throughout the AI development and usage stages. To Parliament Parliament is recommended to enact specific laws that ensure accountability in AI technology.

These laws should define clear responsibilities for developers, deployers, and users of AI technology both in public and private sectors 44See, The Personal Data Protection Act, No. 11 of 2022.

Bibliography

Aldoseri, A. , Al-Khalifa, K. N. , & Hamouda, A. M. (2023). Re-thinking data strategy and integration for artificial intelligence: concepts, opportunities, and challenges. Applied Sciences, 13(12), (pp. 7082). Bakare, S. S. , Adeniyi, A. O. , Akpuokwe, C. U. , & Eneh, N. E. (2024). Data privacy laws and compliance: a comparative review of the EU GDPR and USA regulations. Computer Science & IT Research Journal, 5(3), 528-543. Bharti, S. S. , & Aryal, S. K. (2023). The right to privacy and an implication of the EU General Data Protection Regulation (GDPR) in Europe: Challenges to the companies. Journal of Contemporary European Studies, 31(4), 1391-1402. Chugh, U. (2023). The Evolution of Privacy Laws in the Digital Age: Challenges and Solutions. Indian Journal of Law, 1(1), 51-60. Eleimat, D. , Ebbini, M. , Aryan, L. , & Al-Hawary, S. (2023).

The effect of big data on financial reporting quality. International Journal of Data and Network Science, 7(4), 1775- 1780. Kipingu, M. K. , & Shayo, D. P. (2021). Technology and immigration system: A new paradigm for improving government service delivery in Tanzania. PanAfrican Journal of Governance and Development (PJGD), 2(2), 81-106. Musasa, T. (2023). An Analysis of the 1948 Universal Declaration of Human Rights (UDHR) on Gender Inclusivity. The Fountain: Journal of Interdisciplinary Studies, 7(1), 187- 206. Ndulu, B. , Stuart, E. , Dercon, S. , & Knaack, P. (2023). Driving Digital Transformation: Lessons from Seven Developing Countries (p. 241). Oxford University Press. Joshi, N. (2024). Emerging Challenges in Privacy Protection with Advancements in Artificial Intelligence. International Journal of Law and Policy, 2(4), 55-77. Trivedi, N. K. , Tiwari, R. G. , Jain, A. K.

, Sharma, V. , & Gautam, V. (2023, August). Impact analysis of integrating AI, IoT, Big Data, and Blockchain Technologies: A comprehensive study. In 2023 3rd Asian Conference on Innovation in Technology (ASIANCON) (pp. 1-6). IEEE. Yanamala, A. K. Y. , Suryadevara, S. , & Kalli, V. D. R. (2024). Balancing Innovation and Privacy: The Intersection of Data Protection and Artificial Intelligence. International Journal of Machine Learning Research in Cybersecurity and Artificial Intelligence, 15(1), 1-43. Villegas-Ch, W. , García-Ortiz, J. , & Sánchez-Viteri, S. (2024). Towards Intelligent Monitoring in IoT: AI Applications for Real-Time Analysis and Prediction. IEEE Access.