According to Section 13 of the Online Content Regulations (2020), amending the Electronic and Postal (Online Content) Regulations 2018, internet cafe operators are required to keep a proper service user register and ensure every person using internet service is registered upon showing a recognised identity card; and install surveillance cameras to record and archive activities inside the cafe.

According to the Electronic and Postal (Online Content) Regulations 2018 (last amended in 2020), the application service licensee holders are required to terminate or suspend the subscriber account within two hours after being reported for sharing prohibited content (Section 11.3). While the previous regulation required online platforms to take down alleged illegal content within 12 hours, the current regulation forces license holders — such as the hosts of discussion forums — to remove prohibited content immediately. When a subscriber to a forum uploads alleged illegal content, the license holder must notify the subscriber within two hours. If the subscriber fails to take down content within two hours of getting the notice, the license holder must revoke the subscriber’s access to the platform. In addition, according to Section 9.d, providers are required to use moderating tools to filter prohibited content.

In 2024, Tanzania implemented a series of digital restrictions affecting access to websites and online platforms. In August, the government blocked the social media platform X (formerly Twitter) nationwide following the hacking of the Tanzania Police Force’s official account, which had been used to spread false information. The authorities cited national security concerns and warned that using VPNs to bypass the block could lead to legal penalties. Further actions included the October 2024 suspension of Mwananchi Communications Ltd.’s online platforms for 30 days, following the publication of content deemed threatening to national unity. Additionally, research by the Open Observatory of Network Interference (OONI) documented the blocking of numerous websites and applications related to LGBTIQ issues, including Grindr, between January 2023 and January 2024, as well as restricted access to VPN services, Clubhouse, and 4chan.

The Online Content Regulations, which were first introduced in 2018 and later replaced by the Online Content Regulations of 2020, require online content service providers to have an operating license. The license is applicable to providers who cover news, entertainment, educational, and religious content through blogs, social media pages, and similar services. Therefore, on top of traditional media websites, online TV and radio channels, individual bloggers and podcasters are required to have a license.
According to the regulations, a person can only provide content services after obtaining a license from the Tanzania Communications Regulatory Authority (TCRA). There are four categories of online content licenses available for providers of predominant news and current affairs: entertainment content, educational and religious content, and simulcasting. Upon successful application, the licensee is required to pay an initial fee of TZS 1,000,000 (USD 433 approx.) for a news and current affairs license, TZS 500,000 (USD 216 approx.) for an entertainment and education license or religious content license, and TZS 200,000 (USD 87 approx.) for a simulcasting license. The same fees apply for annual payments and license renewal, and the license is valid for three years. If a licensee breaches the terms and conditions of the license, the license may be suspended or revoked by the TCRA. The licensee is notified of the revocation or suspension and the reasons for it and must surrender the license to the TCRA within seven days after service of the revocation or suspension notice. In addition, the failure to adhere to these regulations makes the service provider liable to a fine of not less than five million shillings (equivalent to approx. 2,150 USD) or imprisonment for a term of not less than 12 months or both.
It is reported that content providers used to be able to register and get a single license to offer different types of content, but with the 2020 Regulations, they are required to obtain numerous permits based on the content they offer and can incur exorbitant licensing fees. In addition, it is reported that as a result of this licensing regime, some blogs were closed down.

Guideline 10 (g) of the Outsourcing Guidelines for Banks and Financial Institutions stipulates that banks and financial institutions are prohibited from outsourcing their primary data centres to locations outside the country. In addition, Art. 42 of the Payment Systems Licensing and Approval Regulations requires a payment system provider to place its primary data centre in relation to payment system services in Tanzania.

Sections 31 and 32 of the Personal Data Protection Act permit the transfer of personal data outside Tanzania only on the following circumstances: a) to a country with an adequate personal data protection legal system (i.e. essentially equivalent levels of protection to that within Tanzania) provided the recipient has proven (i) such transfer is necessary for important reasons of public interest or any other legitimate purpose or (ii) the importance of the transfer and there is no reason to assume that the transfer or processing in the recipient country may prejudice the subject's legitimate interests. The data collector or processor must carry out a prior data protection impact assessment on the need to transfer personal data and ensure the recipient of the data only processes the relevant information in the data and for the purpose for which the data was transferred; b) to any other country with appropriate safeguards on the security and protection of personal data provided the data is transferred to be processed for a purpose approved by the data subject, unless the data subject has consented to such transfer, or the transfer is necessary:
- For the performance of a contract between the data subject and the data collector or the implementation of pre-contractual measures taken at the request of the data subject.
- For the conclusion or performance of a contract concluded or to be concluded in the interest of the data subject between the collector and another person.
- For any public interest or the establishment, exercise or defence of a legal claim.
- To protect the vital interests of the data subject.
- In accordance with a law aimed at giving information to the public, which affords an opportunity for public consultation in general or anyone with a legitimate interest to submit their comments in accordance with a procedure laid down by law.

Tanzania has not joined any free trade agreement committing to open transfers of cross-border data flows.

The Personal Data Protection Act provides a comprehensive regime of data protection in Tanzania. It contains detailed provisions imposing obligations on data controllers and data processors, including requirements associated with data security and international data transfers, and establishes the Personal Data Protection Commission.

Tanzania has not signed the World Intellectual Property Organization (WIPO) Copyright Treaty.

Section 13 of the Online Content Regulations (2020) requires internet cafe operators to:
- keep a proper service user register and ensure every person using internet service is registered upon showing a recognised identity card;
- install surveillance cameras to record and archive activities inside the cafe.
The images recorded by a surveillance camera and the register of users recorded shall be kept for a period of 12 months.

Tanzania has not signed the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

According to the Electronic and Postal Act of 2010, the licensee of a telecommunications licence is required to store subscriber communication data for one month, after which the data must be submitted to the Tanzania Communications Regulatory Authority. Section 91 specifies that: "(1) There shall be a database kept within the Authority in which all Subscriber Information shall be stored. (2) The Authority shall be responsible for monitoring and supervising the information stored under sub-section (1). (3) Every application services licensee shall be required to submit to the Authority, once a month, a list containing its subscribers' information. (4) The Authority shall issue guidelines on the details of subscriber information to be submitted."

Tanzania does not have a comprehensive framework in place that provides effective protection of trade secrets. It is reported that the protection of trade secrets is mostly by way of common law and equity in the form of judicial decisions.

Section 27.3 of the Personal Data Protection Act requires that either the data collector or the data processor must appoint a personal data protection officer who will ensure the security of the data.

It is reported that there is an obligation for passive infrastructure sharing in Tanzania to deliver telecom services to end users. It is practised in both the mobile and fixed sectors based on commercial agreements.