Data Breach Notification under Tanzania’s Personal Data Protection Act: Empirical Evidence and Lessons from European Standards

Section 27(5) of Tanzania’s Personal Data Protection Act, Cap 44 R.E. 2023, obliges a data controller to notify the Personal Data Protection Commission ‘without undue delay’ of any security breach affecting personal data, but does not say how long that is, sets no risk threshold for telling the people whose data has been exposed, and is silent on what a controller must do while the facts of an incident are still emerging. The objective of this article is to examine how effectively that duty operates in practice and to identify the lessons that European standards offer for its reform. Adopting an exploratory, qualitative socio-legal design, the study combines a doctrinal reading of the Act and its 2023 Regulations with semi-structured interviews, analysed thematically, with seven purposively selected key informants: four officers of data controller organisations, an official of the Commission, a legal practitioner and a data protection expert. The findings are read against Articles 33 and 34 of the General Data Protection Regulation, Article 7(2) of Convention 108+ and the guidelines of the European Data Protection Board. Organisations follow a consistent but undocumented sequence of technical, legal and management assessment before notifying; every respondent named the undefined timeframe as the main difficulty; direct notification of data subjects is left to case-by-case discretion; and the Commission escalates from guidance to sanction under clear capacity limits. Respondents also warned, independently, against copying the GDPR’s seventy-two-hour rule without the institutional support that makes it workable. The article proposes a defined notification period with phased disclosure, a statutory high-risk threshold for notifying data subjects, scenario-based guidance and published breach statistics, and argues that resourcing the Commission should precede any tighter deadline.