SMS Marketing in Tanzania: PDPA Rules and PDPC Registration

Before you send SMS marketing in Tanzania, register with the Personal Data Protection Commission (PDPC), collect phone numbers directly from people who know what you will send them, and set up a working way for anyone to stop your marketing, because section 35 of the Personal Data Protection Act 2022 gives every person that right. Transactional messages such as receipts and reminders are treated differently from promotions, but the registration and data-handling rules apply to both. This guide walks through the Act section by section, as it applies to SMS, with a practical pre-send checklist.

Last reviewed: 27 October 2026

This article is a practical summary for marketers, not legal advice. For your specific situation, consult the PDPC or a Tanzanian lawyer.

The law in one paragraph

The Personal Data Protection Act, 2022 (Act No. 11 of 2022) governs how anyone in Tanzania collects and uses personal data. A phone number linked to a name, or even a phone number on its own that identifies a customer, is personal data. The Act created the Personal Data Protection Commission, which registers data controllers and processors, handles complaints and enforces the law. Tanzania has no national do-not-disturb register, so unlike some markets there is no central list to check: the duties sit with you.

Step 1: register with the PDPC (section 14)

Section 14 says a person shall not collect or process personal data without being registered as a data controller or data processor. A business with a customer list on its phone, a CRM or an Excel sheet is collecting and processing personal data. FB Attorneys, writing on Afriwise, reported that the PDPC extended the registration deadline for existing organisations to a final date of 30 April 2025, and that failure to register carries a fine of between TZS 100,000 and TZS 5 million.

Registration lasts five years from the certificate date (section 16), with renewal applied for in the three months before expiry.
Giving false information during registration or renewal is an offence (section 19).
The general penalty for offences without a specific penalty is a fine of TZS 100,000 to TZS 5 million, imprisonment of up to five years, or both (section 63).

Your SMS provider processes data on your behalf. eSMS Africa acts as your processor for the messages you send; your organisation remains the controller and needs its own registration.

Step 2: collect numbers the right way (sections 23 to 25)

Section 23 expects you to collect personal data directly from the person, and before collecting it, to make them aware of the purpose, that the purpose is lawful, and who will receive the data. Section 25 limits use to the purpose it was collected for, and section 24 expects you to keep data accurate.

For SMS marketing, that translates into a few rules:

Say what you will send. "Tick to receive offers and news from Duka Bora by SMS" is clear. A phone number field with no explanation is not.
Do not buy lists. Purchased or scraped number lists were not collected from the person for your purpose.
Do not repurpose delivery numbers. A number given for a delivery or an OTP was given for that purpose. Moving it to a promotional list needs fresh consent.
Remove dead numbers. Use delivery reports to clean numbers that no longer work, which also keeps data accurate.

Step 3: respect the right to stop marketing (section 35)

Section 35(1) says a data subject may require the data controller to stop processing their personal data for purposes of direct marketing. Section 35(3) defines direct marketing as including "the communication by whatever means of any advertising or marketing material which is directed at an individual". An SMS promotion sent to a customer's phone fits that definition.

In practice, you need an opt-out that works and is honoured quickly:

Two-way number: customers reply SIMAMA or STOP, and the reply is recorded as an opt-out automatically. See two-way SMS.
One-way sender ID: customers cannot reply to a name, so do not write "reply STOP". Add a short opt-out link or a phone number instead.
Central opt-out list: keep one list across every campaign and team. The eSMS dashboard blocks sends to opted-out numbers, so a new campaign cannot accidentally reach them.
Record the date and channel of each opt-out, in case you need to show you complied.

Section 35(2) also allows a data subject to agree with a controller to the use of their data for pecuniary benefit, which some loyalty programmes rely on. Keep any such agreement explicit and documented.

Step 4: treat sensitive data with extra care (section 30)

The Act defines sensitive personal data to include data related to children, financial transactions of the individual, and, where processed for what they reveal, data revealing religious beliefs and data concerning health, among others. Section 30 prohibits processing sensitive personal data without the person's prior written consent, which can be withdrawn at any time.

Sector	Why it is sensitive	What to do
Banks, SACCOS, fintech	Financial transactions	Written consent at account opening; no balances to third parties
Schools	Data related to children	Parent or guardian consent at admission; no marketing to pupils
Hospitals, clinics, pharmacies	Data concerning health	Consent at registration; no diagnoses in SMS
Churches and mosques	Religious beliefs	Consent when members join

Sector pages cover these in more depth, for example healthcare SMS in Tanzania and school SMS in Tanzania. Financial providers supervised by the Bank of Tanzania have an additional rule: since the 2025 amendments to the Financial Consumer Protection Regulations (GN 298), they must obtain the consumer's prior consent before using their information for future promotional offers.

Step 5: check where your data goes (sections 31 and 32)

The Act restricts transfers of personal data outside Tanzania to countries with adequate protection, and allows other transfers in listed cases such as the person's consent or the performance of a contract. If your CRM, marketing tool or messaging platform stores data abroad, check the arrangement and mention it in your privacy notice. Hotels and tour operators that exchange guest data with foreign agents should cover this in their booking terms.

Transactional or promotional?

The distinction decides whether section 35 applies, so get it right in your templates.

Transactional (service messages)	Promotional (direct marketing)
Payment receipts and balance alerts	Discounts and seasonal offers
OTP and login codes	New product announcements
Appointment and fee reminders	Loan top-up or cross-sell offers
Delivery and order updates	Event promotions to non-attendees
Service outage notices	Loyalty campaigns and referral drives

A transactional message that slips in an offer ("Your order is confirmed. Get 10% off your next order!") becomes partly promotional. Either keep them separate or make sure the recipient has agreed to marketing.

Other rules that touch SMS marketing

Sender ID registration. Since 16 June 2025, unregistered sender IDs are blocked on the main networks. See the Tanzania sender ID page.
Election periods. For the 2025 General Election, TCRA required election-related bulk SMS to be screened, approved by the relevant institution or party leadership and recorded, as reported by the Daily News.
Accurate offers. The Fair Competition Commission enforces rules against misleading representations, so the price and conditions in your SMS must match the real offer.
Time of day. There is no published legal time window for SMS in Tanzania. Daytime sending is a courtesy, not a statutory rule.

Pre-send checklist

Your organisation is registered with the PDPC, and the certificate is current.
Every promotional contact was collected directly, with a clear statement that you will send SMS marketing.
Written or electronic consent is recorded for any sensitive data, with date and source.
Delivery and OTP numbers are kept separate from marketing lists.
Every promotional message names your business and includes a working opt-out.
Opt-outs from every channel feed one list that blocks future sends.
Your privacy notice explains SMS use and any transfer of data outside Tanzania.
Your sender ID is registered on Vodacom, Airtel, Yas and Halotel.
Someone senior approves campaigns before they go out. eSMS campaign approvals and team roles help here.

Frequently asked questions

Do I need consent to send transactional SMS?

Transactional messages such as receipts and reminders are part of the service the customer asked for, so they are not direct marketing under section 35. You still need to be registered, to collect the number for that purpose and, for sensitive data, to have written consent.

Is a "reply STOP" line enough?

Only if customers can actually reply, which needs a two-way number. On a one-way sender ID, replies go nowhere, so use a short opt-out link or a phone number, and honour opt-outs from any channel.

Can I market to customers who bought from me before?

The Act focuses on telling people the purpose at collection and honouring objections. If customers were told at purchase that you would send offers, marketing them is easier to justify. If not, ask first. Either way, stop as soon as anyone objects.

What happens if I am not registered with the PDPC?

Processing personal data without registration is an offence. Afriwise reports a fine of TZS 100,000 to TZS 5 million for failure to register. Check your status with the PDPC.

Does my SMS provider need to be registered too?

Data processors are covered by the registration requirement in section 14. Ask your provider how it handles your data and where it is stored.

Sources

See how these rules apply to each sector on the Tanzania use-case hub and the retail SMS page. When your list is in order, create a free account and use the built-in opt-out list from your first campaign.