For a European company selling software or services into East Africa, Tanzania currently shows the more visible data-protection enforcement, Uganda the older law with thinner public detail, and both have switched the internet off during recent elections. That is the pattern the public record supports. What it cannot yet support is a ranking of the two as markets, because the telecom and mobile-money statistics that would settle it sit in PDF and spreadsheet reports we could not read.
This is general information, not legal or financial advice. Statute summaries below come from a law-firm survey and the regulators' own sites, not from the Acts themselves, which we could not open.
Key takeaways
- Tanzania's data regulator reports 15,146 registered organisations and 121 cross-border transfer permits as of August 2026; that makes it the clearer compliance target.
- Uganda's Personal Data Protection Office sits inside NITA-U, and a law-firm survey says it has not published a list of countries with adequate protection.
- Access Now records multi-day shutdowns around Tanzania's October 2025 election and Uganda's 15 January 2026 election.
- We could not confirm current mobile-money tax rules or sector headcounts for either country; treat any figure offered to you for those as unverified.
A worked example
Take a Dutch company that sells payroll software. It has two customers: a Dar es Salaam logistics firm and a Kampala bank. Each wants employee records hosted in the Netherlands. Here is what the sources say it would need to do. This is an illustration of the rules as summarised, not a legal opinion.
| Step | Tanzania | Uganda | |---|---|---| | Regulator | Personal Data Protection Commission (PDPC) | Personal Data Protection Office (PDPO), part of NITA-U | | Register | Controllers and processors must register; the PDPC page says personal data may not be collected or processed without registration | Registration with the PDPO, set out in Regulation 13 of the data protection regulations, including outside Uganda if you process Ugandans' data (per DLA Piper) | | Move data abroad | Permit from the PDPC, on grounds such as an international or bilateral agreement or contract safeguards (per DLA Piper) | Section 19: adequate protection abroad, or the data subject's consent (per DLA Piper) | | Breach | Prompt notice to the PDPC, no deadline stated in the survey | "Immediately" to the PDPO (section 23) | | Penalties | Administrative fine up to TZS 100,000,000; company criminal fines TZS 1,000,000 to 5,000,000,000 | Corporate fine up to 2% of annual gross turnover; imprisonment up to 10 years for individuals |
Two points come out of the table. First, in Tanzania the transfer step is a permit you must apply for, and the PDPC page says it had issued 121 by August 2026. A permit regime means the Dutch company's timeline depends on a regulator's queue. Second, in Uganda the same transfer rests on adequacy or consent, which is lighter on paper. But the survey says the adequacy list has not been published, so in practice a European supplier relies on consent, and consent given by employees to an employer is often questioned as a legal basis; ask counsel.
The sources: Tanzania's PDPC site gives the registration requirement, the Act (Personal Data Protection Act, 2022), the 2023 regulations on data collection and processing and on complaints, and August 2026 counts of 15,146 registered organisations, 445 complaints, 121 transfer permits and six determinations. The DLA Piper summary for Tanzania adds that registration lasts five years and that the PDPC was established on 1 May 2023 and became fully operational on 3 April 2024. For Uganda, the DLA Piper page summarises the Data Protection and Privacy Act 2019, says the Office was operationalised in August 2021, and notes that victims must go to court for compensation. NITA-U's own site lists the Personal Data Protection Office as one of its services, but does not mention the 2019 Act or registration, so we rely on the law-firm survey for those.
Our reading: Tanzania is the better-documented place to start a compliance programme, because a regulator that publishes counts can be tested against its own numbers. The counterargument is that publishing counts is not the same as consistent enforcement, and 445 complaints against six determinations says little about outcomes.
Regulators that can switch things off
The telecom regulators are the Tanzania Communications Regulatory Authority (TCRA) and the Uganda Communications Commission (UCC). Both appear in the shutdown record.
Access Now's elections watch records, for Tanzania, a shutdown of about six days around the October 2025 general election, after which African Union observers declared the elections undemocratic. For Uganda it records a complete nationwide blackout of several days around the 15 January 2026 election, ordered by UCC, with Starlink terminals blocked too. Its 2025 Africa report, published 31 March 2026, says Tanzania shut the internet eight times in 2025, two of them in the election period, and that Uganda continued blocking Facebook "for the fifth year running".
Those are observed events by an advocacy group that campaigns against shutdowns, so read them with that in mind. Neither government's account is in our sources.
For a buyer, this changes the contract more than the strategy. Besides full blackouts, Access Now says Uganda's Facebook block continues. Ask vendors to show how they work during a full blackout: offline-capable software, a second operator's connection, and a fallback office in another country. A clause that excludes shutdowns from penalties is reasonable, one that excludes them from the vendor's duty to communicate is not.
Separately, TCRA's public notices in September and October 2026 show a steady stream of licence applications under a "Converged Licensing Framework", with notices dated 14, 15 and 22 September and 8 and 16 October. The framework's contents are not summarised on that page, so we cannot say what it changes. A notice dated 8 October 2026 is titled "Cessation of airtime scratch cards usage and promotion of digital airtime recharge"; the text was not readable, so we cannot say what it requires or when it applies.
What we could not read
Uganda's UCC lists quarterly market reports through Q2 2026 on its market performance page. The Q2 2026 PDF is a 16 MB file whose text we could not extract, so we give no subscription or mobile-money counts for Uganda. TCRA's statistics page loaded without figures. The Bank of Tanzania's site links spreadsheets on mobile transactions and cites the National Payment Systems Act of 2015, but we did not open them; its home page also showed draft banking regulations out for comment until 28 October 2026, which concern banks rather than payments (Bank of Tanzania). The Bank of Uganda site gave us nothing usable.
That means we cannot report current mobile-money tax rules for either country. We did not find a primary source we could open, so check the revenue authorities' current guidance and your vendor's pricing before assuming the cost of a payment flow.
NITA-U states on its own site that 1,466 or more National Backbone Infrastructure sites are connected, and that its National Data Centre hosts more than 276 systems for more than 135 government entities. Those are the agency's counts of its own public infrastructure, not private-sector capacity.
The EAC link
Both are members of the East African Community (EAC). The EAC site lists the Eastern Africa Regional Digital Integration Project, which it says aims to advance digital market integration by increasing affordable broadband access and enhancing cross-border digital services. Its news feed carried a 16 October 2026 item titled "EAC Partner States Advance Measure to Strengthen E-Commerce and Digital Trade", but the page showed only the headline, so we cannot describe the measure (EAC). Do not assume a supplier licensed in one member state can serve the other without a separate check of both countries' rules.
Buyer guidance
- Run two compliance tracks. Register in both regimes and plan for the Tanzanian transfer permit lead time before a contract start date.
- Test the vendor in a blackout. Ask for a written plan covering a national shutdown lasting several days, since both countries had one in the last twelve months.
- Do not rely on headcount claims. We found no credible count of developers or BPO seats in either country; ask for payroll or contract evidence.
- Check payment costs yourself. Obtain current guidance from the revenue authority and the central bank for any flow that touches mobile money.
- Language and time. Both countries sit on East Africa Time (UTC+3), one hour ahead of Central European Summer Time. English is the working business language in Uganda, and Swahili and English are both used in Tanzania; a Swahili-capable customer support team is an advantage for consumer products.
- Shortlist from profiles, then verify. The Tanzania and Uganda pages list companies and basic details, Find a partner filters by category, and the countries overview compares markets side by side. Licences, security certificates and registrations still need checking at source.
Frequently asked questions
Do we have to register with the data regulator if my servers are in Europe? In Tanzania the PDPC says all institutions must register before processing; in Uganda, DLA Piper's survey says registration applies even outside Uganda if you process Ugandans' data. Confirm both with local counsel.
Which country is easier for cross-border data transfers? On paper, Uganda, which relies on adequacy or consent, while Tanzania requires a PDPC permit. In practice, Uganda's adequacy list was reported as unpublished.
Has either country cut the internet recently? Yes. Access Now records multi-day shutdowns around Tanzania's October 2025 election and Uganda's 15 January 2026 election.
Is Facebook available in Uganda? Access Now reported on 31 March 2026 that Uganda continued blocking Facebook for the fifth year running. We did not verify whether the block changed after that.
Sources
- Personal Data Protection Commission, Tanzania, pdpc.go.tz
- DLA Piper, Tanzania and Uganda data protection summaries
- NITA-U, nita.go.ug
- Access Now, 2026 elections watch and 2025 Africa report
- TCRA, document library
- UCC, market performance reports
- Bank of Tanzania, bot.go.tz
- East African Community, eac.int