Introduction
The rapid diffusion of artificial intelligence across healthcare, banking, education, transportation, law enforcement, and electronic commerce has reshaped the manner in which personal information is collected, processed, and used.1 AI systems rely on large volumes of personal data, including biometric identifiers, financial records, behavioral patterns, and location data, and where such data is inaccurate, excessive, or unlawfully obtained, the consequences may include algorithmic discrimination, unlawful profiling, and unauthorized disclosure of confidential information.
Traditional data protection statutes were not designed with AI-specific risks such as automated decision-making, algorithmic opacity, and generative content in view.2 Jurisdictions have responded unevenly to this challenge. The European Union adopted a horizontal, risk-tiered Artificial Intelligence Act in 2024, while China has developed a dense statutory architecture comprising the Cybersecurity Law 2017, the Data Security Law 2021, the Personal Information Protection Law (PIPL) 2021, and the Interim Measures for the Management of Generative Artificial Intelligence Services 2023.3
Tanzania’s regulatory posture, by contrast, remains at a comparatively early stage. The Personal Data Protection Act 2022 (PDPA) marked a significant step toward recognizing data protection as a distinct legal interest, and has since been supplemented by two sector-specific instruments bearing on AI: the Bank of Tanzania (Fintech Regulatory Sandbox) Regulations 2024,4 and the Ministry of Education, Science and Technology’s National Guidelines for Artificial Intelligence in Education 2025.5 Neither instrument amounts to a comprehensive statutory framework governing artificial intelligence, algorithmic accountability, or automated processing, and the PDPA itself addresses automated decision-making in only two brief provisions.6
This article undertakes a comparative doctrinal analysis of the legal frameworks of Tanzania and China governing the protection of personal data in the AI environment. It asks, first, what legal frameworks govern personal data protection and artificial intelligence in the two jurisdictions; second, what challenges each jurisdiction’s framework presents in the AI environment; and third, what legal and institutional reforms may improve the adequacy of Tanzania’s framework. The study relies on documentary review of primary legal instruments and secondary scholarly literature, and adopts a functional comparative method in the tradition of Zweigert and Kötz, which proceeds from a shared social problem, here the risk that AI poses to personal data, rather than from formal doctrinal categories alone.7
Literature review
The relationship between artificial intelligence and personal data protection has attracted sustained academic attention, though the resulting literature remains unevenly distributed across jurisdictions and, in particular, offers limited comparative treatment of African and Chinese law. This section reviews the principal strands of that literature, organized around the technical, critical, doctrinal, and jurisdiction-specific contributions most relevant to the present comparison.
At the technical level, Russell and Norvig explain that contemporary AI systems derive their predictive capability from the statistical analysis of large training datasets, and observe that this data dependence extends across healthcare, finance, education, and security applications.8 Their account is valuable in establishing why AI regulation is, as a technical matter, inseparable from data protection regulation, but it is written from a computer-science standpoint and offers no legal analysis of how such dependence ought to be governed, a gap the present article seeks to address from a doctrinal legal perspective.
A more critical strand of literature is represented by Zuboff, who argues that digital corporations extract human experience as raw material for behavioral prediction and, ultimately, for the modification of human behavior at scale, a phenomenon she terms surveillance capitalism.9 Pasquale similarly warns that algorithmic decision-making systems function as an opaque ‘black box’, concealing from affected individuals the basis on which decisions about them are made.10 Both contributions are important in identifying the structural, rather than merely individual, character of the harm posed by AI-driven data processing, but both focus primarily on Western, and particularly United States, digital markets, and neither engages with the regulatory position of developing jurisdictions such as Tanzania or with state-centered jurisdictions such as China.
At the doctrinal level, Solove and Schwartz trace the evolution of privacy law and argue that traditional data protection statutes are increasingly inadequate to regulate AI systems that process personal data in complex and opaque ways, calling for stronger accountability and transparency mechanisms.11 Wachter, Mittelstadt and Floridi advance this analysis specifically in relation to automated decisions, arguing that individuals affected by such decisions often cannot ascertain the reasoning behind them because of algorithmic opacity, and that meaningful transparency and explainability safeguards are therefore essential to AI governance.12 Kaminski and, separately, Edwards and Veale examine the scope and practical limits of a legal ‘right to explanation’, with the latter cautioning that a bare textual entitlement to explanation, without more, does not guarantee that the explanation supplied will be intelligible or capable of remedying an underlying discriminatory design.13 This body of work is directly relevant to the analysis of article 24 of China’s PIPL undertaken in Part 4.3 below, though it is drawn overwhelmingly from the European and North American experience and does not evaluate developing legal systems such as Tanzania’s.
Kuner examines the legal implications of cross-border data transfer in the digital economy, explaining that globalization and cloud computing have enabled multinational corporations to transfer personal data across jurisdictions in ways that complicate the enforcement of domestic privacy law.14 This work is relevant because many AI systems operating in Tanzania involve precisely this kind of cross-border processing, although, having been written before the recent expansion of generative AI, it offers limited analysis of AI-specific regulatory challenges of the kind addressed in this article.
With regard to China, Greenleaf examines the completed PIPL and argues that China has established one of the more comprehensive personal data protection frameworks in Asia, through detailed rules on consent, sensitive personal information, and automated decision-making, while noting that concerns remain regarding state surveillance powers and the balance between individual privacy rights and national security interests.15 Creemers similarly analyses the rapid expansion of China’s digital governance system, explaining that Chinese data protection combines privacy regulation with cybersecurity and state-control objectives through the joint operation of the PIPL and the Data Security Law.16 These contributions are valuable in demonstrating how China regulates AI technologies through centralized legal mechanisms, but they are oriented toward policy analysis internal to China and do not undertake comparative analysis with African legal systems, a gap this article addresses directly.
Tanzanian-focused scholarship remains comparatively sparse. The most systematic recent assessment is UNESCO’s Artificial Intelligence Readiness Assessment of Tanzania, which records that the country was at the inception stage of developing a national approach to AI governance, with a draft National AI Strategy in preparation and sector-specific frameworks emerging in health and education.17 The assessment notes that the PDPA confers rights in relation to automated decision-making, but finds that clear rules on liability for decisions made by autonomous or opaque AI systems are still lacking.18 It is, however, a policy diagnosis rather than a legal analysis: it does not examine how the PDPA’s provisions on automated processing would operate against AI-driven decisions, it does not offer a comparative perspective against a more developed AI-governance jurisdiction such as China, and it does not examine the Bank of Tanzania’s Fintech Regulatory Sandbox discussed in Part 4 below.
Taken as a whole, the reviewed literature demonstrates a well-developed technical and critical understanding of the relationship between artificial intelligence and personal data, and an increasingly detailed doctrinal literature on automated decision-making and algorithmic accountability, concentrated primarily in the European Union, United States, and Chinese contexts. What remains comparatively underexplored is a systematic, comparative legal analysis of the adequacy of Tanzania’s personal data protection framework, including its emerging sector-specific AI directives, measured against a jurisdiction with a considerably more developed AI-specific statutory architecture. This article seeks to address that gap through the comparative analysis undertaken in the parts that follow.
Conceptual and theoretical framework
Personal data is generally understood as any information relating to an identified or identifiable natural person. Tanzania’s PDPA and China’s PIPL define the concept in materially similar terms, and both statutes recognize a heightened category of sensitive personal data, including biometric, financial, health, and children’s data, attracting stricter processing conditions.19 Automated decision-making, for its part, refers to a decision produced by technological means without meaningful human involvement, while profiling denotes the automated processing of personal data to evaluate or predict aspects of an individual’s performance, economic situation, health, or behavior.
The article situates its analysis within a composite theoretical framework combining three perspectives. The human rights-based theory treats data protection as an instrumental right giving effect to the more foundational rights to privacy and dignity, and is particularly apt for evaluating Tanzania’s constitutional order, given that article 16 of the Constitution of the United Republic of Tanzania 1977 expressly and independently guarantees the right to privacy.20 The risk-based regulatory theory holds that the intensity of legal regulation imposed on a data-processing activity ought to be proportionate to the risk it poses, a theory that underpins the tiered approach of the EU’s Artificial Intelligence Act and finds partial expression in both Tanzania’s sector-specific sandbox and China’s layered statutory measures on generative AI. Finally, Westin’s theory of informational control, which frames privacy as the individual’s claim to determine when, how, and to what extent information about them is communicated to others,21 supplies the interpretive lens for assessing the degree of meaningful control, through consent, access, and objection rights, that data subjects retain over AI-driven processing in each jurisdiction.
Legal and institutional frameworks compared
A. Constitutional and rights-based foundations
The constitutional starting points of the two jurisdictions diverge in a manner that carries consequences throughout their respective regimes. Article 16 of the Tanzanian Constitution expressly and independently guarantees the right to privacy, positioning the individual’s interest in personal data as a directly enforceable fundamental right. By contrast, articles 38 and 40 of the Constitution of the People’s Republic of China 1982 protect privacy only derivatively, through the broader guarantees of personal dignity and of the freedom and privacy of correspondence, without according it the status of a freestanding right.22 This divergence is compounded by the two states’ differing treaty postures: Tanzania acceded to the International Covenant on Civil and Political Rights 1966 in 1976, whereas China signed but has never ratified the Covenant, leaving China’s data protection statutes without an equivalent binding international human rights foundation, notwithstanding the emergence of a private-law analogue to privacy protection under the personality-rights book of China’s Civil Code 2020.23
B. Statutory data protection principles
At the level of statutory principle, the two jurisdictions display considerable convergence, reflecting the shared influence of the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data 1980. Both the PDPA and the PIPL adopt materially similar principles of lawfulness, purpose limitation, data minimization, accuracy, and security.24 Beneath this surface convergence, however, lies significant divergence in regulatory depth. The PIPL devotes a dedicated section of its rules on processing to sensitive personal information, requiring separate consent, and requires a personal information protection impact assessment before such processing begins; it also requires ‘separate consent’, as distinct from ordinary consent, for other particularly invasive processing such as cross-border transfer.25 Tanzania’s PDPA requires prior written consent for the processing of sensitive personal data, subject to broad exceptions, but the Act itself imposes no impact-assessment requirement; that duty appears only in its 2023 implementing regulations, which require a data protection impact assessment before processing likely to affect the data subject’s rights and freedoms, including automated decision-making with significant legal effect, the processing of biometric or genetic data, and the processing of sensitive data relating to children or vulnerable groups.26 That the impact-assessment duty rests on subsidiary legislation rather than on the Act is of particular significance given that AI systems deployed under Tanzania’s sandbox and education directives routinely process biometric and behavioral data of precisely this kind.
C. Automated decision-making
The regulation of automated decision-making constitutes the sharpest point of divergence between the two frameworks. Article 24 of the PIPL requires that automated decision-making be transparent and produce fair and just outcomes, prohibits unreasonable differential treatment in transaction prices and other transaction terms, and, where a decision made by automated means significantly affects an individual’s rights and interests, entitles the individual to demand an explanation and to refuse to have the decision made solely by automated means.27 The PDPA addresses the subject far more narrowly. Section 33(1)(c) entitles a data subject, on an access request, to be told the logic involved where automatic processing is, or is likely to be, the sole basis of a decision significantly affecting him, and section 36 allows a data subject to require that such decisions not be based solely on automated processing, obliges the controller to notify the data subject where one is, and allows the data subject to require the controller to reconsider it; the 2023 regulations add a written notice giving basic information about the processing and its intended purpose, a right to reject the use of one’s personal data in a decision made by automatic means, and a direction that controllers consider incorporating human intervention to minimize the biases that automated decision-making processes may create.28 The protection nonetheless remains thin, and much of it rests on subsidiary legislation. The Act does not define automated decision-making, imposes no duty comparable to article 24 to ensure the transparency of automated decision-making and the fairness of its results, and no prohibition of differential treatment, and disapplies section 36 altogether where the decision is necessary for entering into or performing a contract with the data subject, is authorized by any written law, or rests on the data subject’s explicit consent. This is a substantive gap, since the very applications Tanzania has chosen to permit, AI-powered credit scoring and fraud detection within the Bank of Tanzania’s sandbox, and AI-driven learner assessment under the Ministry of Education’s guidelines, are paradigmatic instances of automated decision-making of the kind China’s law expressly regulates, and a credit decision taken in entering into a loan contract may fall within the contractual exception. Comparative scholarship nonetheless cautions against overstating the practical efficacy of textual transparency rights, since a bare right to explanation does not, without more, guarantee that the explanation supplied will be intelligible or capable of remedying an underlying discriminatory design.29
D. Generative artificial intelligence
China has enacted a dedicated, binding instrument regulating generative AI, the Interim Measures for the Management of Generative Artificial Intelligence Services 2023, which require providers to use data and foundation models from lawful sources, to take effective measures against discrimination in algorithm design and training-data selection, to label generated content such as images and video, and, where a service has public-opinion attributes or the capacity for social mobilization, to undergo a security assessment and file its algorithm.30 This is reinforced by the Provisions on the Administration of Algorithm-Generated Recommendations for Internet Information Services 2022, which require providers to inform users that algorithmic recommendation is in use, to publicize the basic principles, purposes, and main operating mechanisms of the service, and to label algorithmically generated or synthesized information,31 and by the Provisions on the Administration of Deep Synthesis Internet Information Services 2023, which require labels on content generated or edited by deep synthesis and conspicuous labels wherever such content may confuse or mislead the public.32 Tanzania possesses no equivalent binding instrument. Neither the PDPA nor its sector-specific directives impose training-data verification, content-labelling or, outside the education sector, bias-auditing obligations on providers of generative AI services accessible to Tanzanian consumers, students, and financial institutions, a gap of considerable practical concern given the global availability of such tools.
E. Institutional architecture
The Cyberspace Administration of China occupies a centralized, technically specialized coordinating role, vested with statutory authority under the PIPL to coordinate personal information protection and to organize the security assessments required for cross-border transfers, and acting as lead issuer of the principal AI-specific instruments. It is supported by the National Cybersecurity Standardization Technical Committee (TC260, formerly the National Information Security Standardization Technical Committee) and by specialized Internet Courts in Hangzhou, Beijing, and Guangzhou with dedicated jurisdiction over internet-related disputes, including online infringement.33 Tanzania’s institutional framework, by contrast, remains fragmented across the Personal Data Protection Commission, the Bank of Tanzania, the Tanzania Communications Regulatory Authority, and the Ministry of Education, Science and Technology, without a coordinating body possessing overarching authority over AI governance across sectors, and without dedicated technical capacity for algorithmic auditing.
F. Cross-border data transfer
China’s PIPL requires that cross-border transfers be accompanied by a security assessment organized by the Cyberspace Administration, certification, or a standard contract, and requires critical information infrastructure operators and high-volume processors to store personal information in China and to pass a security assessment before transferring it abroad unless laws, administrative regulations, or the Cyberspace Administration provide otherwise, situating the requirement within a wider data-localization architecture reflective of a securitized model of digital sovereignty.34 Tanzania’s PDPA adopts an adequacy-based model closer in structure to that of the European Union, permitting transfer where the receiving jurisdiction maintains an adequate level of protection or appropriate safeguards are otherwise in place, subject to a transfer permit from the Personal Data Protection Commission under the 2023 regulations. However, Tanzania’s regime lacks implementing infrastructure, such as a published list of adequate jurisdictions or standard contractual clause templates, necessary to render the adequacy requirement operable in practice, a shortcoming of particular significance given that much of Tanzania’s AI infrastructure is hosted on foreign cloud platforms.35
Discussion
The comparative analysis reveals both significant convergence and significant divergence. Both jurisdictions have enacted comprehensive general data protection statutes within a similar timeframe, grounded in the same internationally recognized fair information principles, and both have thus far chosen to regulate artificial intelligence primarily through sector-specific or interim instruments rather than a single horizontal AI statute. In neither jurisdiction has the judiciary yet developed a substantial body of case law addressing algorithmic discrimination, notwithstanding China’s establishment of specialized Internet Courts, indicating that the judicial testing of AI-specific legal principles remains at an early stage even in the more developed of the two systems.
The divergence, however, is more consequential. China has enacted a binding statutory provision on automated decision-making and dedicated instruments regulating generative AI, algorithmic recommendation, and deep synthesis, administered by a centrally coordinated, technically specialized regulator. Tanzania’s only AI-specific instruments remain a non-binding education guideline and a sector-confined regulatory sandbox, administered across fragmented institutions lacking a unifying coordination mechanism. At the same time, China’s model carries its own cost: its non-ratification of the ICCPR, its dignity-derived rather than freestanding constitutional privacy protection, and the extensive state-security carve-outs embedded within the Cybersecurity Law and Data Security Law together suggest that the principal beneficiary of China’s architecture may, in important respects, be the state’s interest in cybersecurity and social stability rather than the individual data subject’s interest in informational self-determination.36
Findings: legal gaps in Tanzania’s framework
Drawing on the comparative analysis undertaken above, and measured against the composite theoretical framework of human rights, risk-based regulation, and informational control adopted in this article, five specific and interrelated gaps in Tanzania’s present legal framework can be identified. Each is discussed in turn below, together with an explanation of why the gap matters in practice and how it manifests within Tanzania’s own sector-specific AI deployments.
A. Absence of a statutory definition of artificial intelligence and of a horizontal AI statute
Tanzanian law nowhere defines artificial intelligence, an AI system, or an algorithmic decision-making process. This is not a merely semantic omission. A statutory definition performs the essential legal function of fixing the scope of application of any subsequent obligation, whether that obligation concerns transparency, bias auditing, or liability; without it, regulators, courts, and AI developers operating in Tanzania lack a common, judicially cognizable threshold at which AI-specific obligations, as opposed to ordinary data-processing obligations, are triggered.
The practical consequence of this omission is that AI governance in Tanzania is presently conducted entirely through sectoral guidelines and a time-limited regulatory sandbox, neither of which possesses the force of law outside its own narrow administrative confines. The Bank of Tanzania (Fintech Regulatory Sandbox) Regulations 2024 apply only to entities admitted into the sandbox and only for the testing period, twelve months unless the Bank extends it, while the National Guidelines for Artificial Intelligence in Education 2025 are a ministerial policy instrument rather than legislation, which each educational institution is expected to domesticate through its own institution-specific AI policy.37 A horizontal AI statute, by contrast, would extend baseline obligations to every deployment of AI technology in Tanzania, irrespective of the sector in which it occurs, closing the coverage gap that presently leaves AI use in healthcare, transport, and law enforcement, sectors outside the scope of either existing directive, entirely unregulated from an AI-specific standpoint.
B. A narrow and qualified right to contest automated decisions
The second and, in the view of this article, most consequential gap lies in the PDPA’s treatment of automated decision-making. Sections 33(1)(c) and 36 entitle a data subject to be told the logic of a solely automated decision on an access request, to require that a decision significantly affecting him not be based solely on automated processing, to be notified that such a decision has been taken, and to require the controller to reconsider it, and the 2023 regulations add a right to reject the use of one’s personal data in such a decision; but the Act contains no definition of automated decision-making, no transparency or fairness standard specific to automated decisions, and no express requirement that reconsideration be carried out by a human, and section 36 does not apply at all to decisions necessary for a contract, authorized by written law, or based on explicit consent.38 This stands in direct contrast to article 24 of China’s PIPL, which requires automated decisions to be transparent and to produce fair and just outcomes, and which, where a decision made by automated means significantly affects an individual’s rights and interests, confers a right to demand an explanation and to refuse to have the decision made solely by automated means.
The significance of this gap is best appreciated by reference to Tanzania’s own AI deployments. Digital lending and artificial intelligence and machine-learning applications are expressly listed among the financial solutions that may be tested in the Bank of Tanzania’s Fintech Regulatory Sandbox, so that AI-powered credit scoring and automated fraud detection fall within its scope.39 Tanzanian consumers may therefore already be, or shortly will be, subject to automated creditworthiness assessments in which, if the decision is treated as necessary for entering into a loan contract, the section 36 entitlements to notice and reconsideration fall away, and in which nothing in the Act guarantees that a human will review the decision before it takes effect. Equally, AI-driven learner assessment tools contemplated under the Ministry of Education’s Guidelines raise the prospect of students receiving automatically generated academic evaluations that carry real consequences for progression or certification, with only the qualified protections of sections 33(1)(c) and 36 and of the 2023 regulations, and no avenue for contestation specific to education.40 Viewed through the human rights-based theory adopted, this is not a minor procedural lacuna but a substantive failure to extend Tanzania’s constitutionally guaranteed right to privacy under article 16 fully into the one context, automated processing, where the risk of an opaque and unreviewable intrusion into that right is at its highest.
C. Absence of binding regulation of generative artificial intelligence
Third, Tanzania has no binding instrument imposing training-data lawfulness verification, content-labelling, or bias-mitigation obligations on providers of generative AI services. This gap is compounded by the fact that most generative AI tools accessible to Tanzanian users, whether large language models, image generators, or AI-assisted financial advisory chatbots, are supplied by foreign technology companies whose training-data practices, data-sourcing jurisdictions, and content-moderation standards fall entirely outside Tanzanian regulatory visibility.
The absence of a content-labelling requirement is of particular concern in the financial and education sectors that Tanzania has itself chosen to open to AI experimentation: a bank customer receiving AI-generated financial advice through a sandbox-approved fintech product, or a student engaging with an AI-generated study aid under an institution’s AI policy, presently has no statutory assurance that the content they are relying upon is machine-generated, still less any guarantee that the underlying model was trained on lawfully sourced, non-discriminatory data. China’s Interim Measures for the Management of Generative Artificial Intelligence Services 2023 address precisely this risk, but Tanzania’s sector directives, confined as they are to sandbox testing and institutional policy, do not.
D. Absence of specialized institutional and technical capacity
Fourth, no Tanzanian regulator presently possesses a dedicated technical capacity to audit algorithmic systems, assess AI-related bias, or set AI-specific technical standards. The Personal Data Protection Commission’s statutory functions under section 7 of the PDPA centre on compliance monitoring, registration, complaint-handling and investigation, public education, research and the monitoring of technological developments in data processing, and cooperation with foreign data protection authorities,41 functions calibrated to conventional data processing rather than to the interrogation of machine-learning models.
This institutional deficit is aggravated by fragmentation: AI governance responsibility is presently distributed across the Personal Data Protection Commission, the Bank of Tanzania, the Tanzania Communications Regulatory Authority, and the Ministry of Education, Science and Technology, with no memorandum of understanding, joint working group, or statutory coordination mechanism linking their respective AI-related mandates. The absence of a body performing a function analogous to China’s TC260 means that Tanzania also lacks an authoritative source of technical benchmarks, such as standards for bias testing, model documentation, or security assessment, against which compliance by AI developers and deployers could be measured or audited in the first place.
E. Incomplete cross-border data transfer regime and non-ratification of the Malabo Convention
Fifth, while the PDPA adopts a structurally sound, adequacy-based model for cross-border data transfer, this model presently lacks the implementing detail necessary for it to function in practice, most notably a published list of jurisdictions recognized as maintaining an adequate level of protection, and standard contractual clause templates that data controllers could adopt where the receiving jurisdiction is not on such a list. In the absence of this implementing detail, Tanzanian data controllers transferring personal data to foreign-hosted AI infrastructure, which, given the near-total reliance of AI systems on cloud computing, is the practical reality for almost every AI deployment in Tanzania, have no clear, predictable compliance pathway to follow.
This weakness is compounded at the regional level by Tanzania’s continued non-ratification of the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) 2014, which Tanzania has neither signed nor ratified, notwithstanding the Convention’s entry into force in June 2023.42 Ratification would bind Tanzania to a regional minimum standard requiring an independent data protection authority and domestic legislation addressing automated processing, providing an external, treaty-based impetus for the statutory reforms identified above that has, to date, been entirely absent from Tanzania’s reform trajectory.
Recommendations
In response to the five gaps identified, this article advances seven specific, sequenced recommendations. Each recommendation is deliberately framed as a selective adaptation of an identifiable feature of China’s regulatory model, reconstructed to operate within, rather than in substitution for, Tanzania’s own rights-based constitutional order under article 16 of the Constitution. The recommendations are not intended as a checklist of isolated reforms but as a coherent reform package in which the statutory, institutional, and regional elements reinforce one another.
A. Enactment of a comprehensive artificial intelligence statute
Tanzania should enact a dedicated, horizontal statute regulating artificial intelligence. Such a statute should, at a minimum, provide a clear statutory definition of artificial intelligence and of an AI system broad enough to capture both discriminative and generative models; adopt a risk-based classification of AI applications, loosely modelled on the tiered approach of the European Union’s Artificial Intelligence Act, distinguishing, for instance, between minimal-risk applications, high-risk applications such as credit scoring and learner assessment, and prohibited applications; and consolidate the presently fragmented Fintech Regulatory Sandbox Regulations and the National Guidelines for Artificial Intelligence in Education within a single coherent instrument, so that sector-specific rules operate as delegated elaborations of a common statutory baseline rather than as freestanding, disconnected instruments of differing legal force. This statute should be drafted to extend, rather than merely parallel, the general principles already established under the PDPA, so that AI-specific obligations are read together with, and enforceable through, Tanzania’s existing data protection architecture.
B. Strengthening the statutory right to contest automated decisions
Sections 33 and 36 of the PDPA should be amended, drawing on but not copying article 24 of China’s PIPL, so that data subjects hold three specific and cumulative entitlements: first, a right to be informed that a decision affecting them was made wholly or predominantly, and not only solely, by automated means; second, a right to obtain meaningful information about the logic, significance, and envisaged consequences of that decision, calibrated to what is intelligible to a lay data subject rather than a bare technical disclosure; and third, a right to request review of the decision by a human, rather than mere reconsideration by the controller, before it takes final effect, particularly in circumstances producing a legal or similarly significant effect. The amendment should apply with immediate and explicit effect, notwithstanding the contractual, statutory-authorization, and consent exceptions now in section 36(3), to AI-driven credit scoring and fraud detection conducted within the Bank of Tanzania’s Fintech Regulatory Sandbox and to AI-driven learner assessment conducted under the Ministry of Education’s Guidelines, given that these are the two contexts in which Tanzanian data subjects are presently, or imminently, exposed to automated decisions of real consequence. Consistent with the caution expressed by comparative scholarship on the limits of a bare right to explanation, the amendment should be paired with a complementary institutional duty, discussed in the fourth recommendation below, requiring the Personal Data Protection Commission to verify, rather than merely receive, evidence that a human review mechanism is genuinely operative and not a token formality.
C. Regulation of generative artificial intelligence services
Tanzania should adopt binding regulations, whether as subsidiary legislation under the recommended AI statute or as an amendment to the Personal Data Protection (Personal Data Collection and Processing) Regulations 2023, governing generative AI services made available to, or targeted at, users within Tanzania. These regulations should require providers to verify and document the lawfulness of the sources of their training data; to label AI-generated content, including text, images, audio, and financial or educational advisory output, in a manner readily discernible to the ordinary consumer or student; and to implement and document measures to detect and mitigate discriminatory algorithmic bias before deployment. The regulations should draw appropriately, though not uncritically, on the structural approach of China’s Interim Measures for the Management of Generative Artificial Intelligence Services 2023, while omitting those elements of the Chinese instrument, such as content requirements tied to state ideological objectives,43 that are inconsistent with Tanzania’s own constitutional guarantees of expression and are, in any event, unnecessary to achieve the data protection objectives with which this article is concerned.
D. Strengthening of institutional and technical capacity
The Personal Data Protection Commission should be equipped, whether through additional statutory powers, budgetary allocation, or a dedicated directorate, with a technical unit possessing the capacity to audit algorithmic systems, assess AI-related bias, verify the operation of the human review mechanisms recommended above, and coordinate AI governance across the financial, education, and other emerging sectors. This should be accompanied by the establishment of a national technical standards body, performing a function analogous to China’s TC260, tasked with developing authoritative Tanzanian technical standards for AI documentation, bias testing, and security assessment, against which compliance by AI developers and deployers can be measured. To address the coordination gap identified, the article further recommends the establishment of a standing inter-agency AI governance committee, drawing together the Personal Data Protection Commission, the Bank of Tanzania, the Tanzania Communications Regulatory Authority, and the Ministry of Education, Science and Technology, with a mandate to harmonize sector-specific AI directives and to report jointly on AI-related risks and incidents.
E. Ratification of the Malabo Convention
Tanzania should ratify the African Union Convention on Cyber Security and Personal Data Protection 2014, thereby binding itself to a regional standard requiring the establishment of an independent data protection authority and the extension of domestic law to the risks posed by automated processing. Ratification would provide an external, treaty-based benchmark against which the reforms recommended above could be measured and reported, strengthening the regional legal foundation for Tanzania’s domestic AI law reform and aligning Tanzania with the wider African Union Continental Artificial Intelligence Strategy 2024, which calls upon member states to develop national AI governance frameworks anchored in human rights, data protection, transparency, and accountability.44
F. Judicial capacity building
Specialized judicial or quasi-judicial capacity should be developed, whether through a designated division of the High Court or a specialized tribunal, to adjudicate disputes concerning personal data protection and algorithmic accountability. Such a forum, informed by, though not identical to, the model of China’s specialized Internet Courts, would begin the development of a body of Tanzanian jurisprudence on AI-related data protection disputes that presently does not exist.
G. Operationalization of the cross-border transfer regime
The Personal Data Protection Commission should develop and publish detailed implementing guidance under the PDPA, including a published list of jurisdictions deemed to maintain an adequate level of data protection and standard contractual clause templates, so as to render Tanzania’s cross-border data transfer regime practically operative in respect of the foreign-hosted cloud infrastructure upon which Tanzania’s AI deployments presently depend.
Taken together, these seven recommendations are designed to be implemented not through the uncritical transplantation of China’s security-oriented regulatory model, but through a selective, contextually grounded adaptation of specific regulatory techniques within Tanzania’s own constitutionally entrenched, rights-based framework for the protection of personal data.
Conclusion
This article has undertaken a comparative doctrinal analysis of the legal protection of personal data in the artificial intelligence environment in Tanzania and China. It has shown that although Tanzania has made meaningful legislative progress through the Personal Data Protection Act 2022 and its sector-specific AI directives, its framework remains substantially under-developed in addressing AI-specific risk when measured against China’s considerably more elaborate and institutionally centralized architecture. The appropriate direction of reform for Tanzania, however, is not the uncritical transplantation of Chinese regulatory technique, which is shaped by a security-oriented rationale not fully compatible with Tanzania’s own constitutionally entrenched, rights-based conception of privacy, but a selective adaptation of specific mechanisms, most notably fuller statutory treatment of automated decision-making and binding regulation of generative AI, reconstructed within a framework that gives primacy to the individual data subject’s right to privacy. Given the accelerating deployment of AI technologies within Tanzania’s financial, educational, and other emerging sectors, such reform is both necessary and increasingly urgent.
*****
Footnotes
1. Stuart Russell & Peter Norvig, Artificial Intelligence: A Modern Approach 1027–31 (4th ed. 2021).
2. Sandra Wachter, Brent Mittelstadt & Luciano Floridi, Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation, 7 Int’l Data Priv. L. 76, 76–82 (2017), https://doi.org/10.1093/idpl/ipx005.
3. Graham Greenleaf, China’s Completed Personal Information Protection Law: Rights Plus Cyber-Security, 172 Priv. L. & Bus. Int’l Rep. 20, 21–23 (2021); see also Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), 2024 O.J. (L 1689) 1; Interim Measures for the Management of Generative Artificial Intelligence Services (生成式人工智能服务管理暂行办法) (promulgated by the Cyberspace Admin. of China et al., July 10, 2023, effective Aug. 15, 2023) (China), https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm [hereinafter Generative AI Measures].
4. Bank of Tanzania (Fintech Regulatory Sandbox) Regulations, 2024, G.N. No. 540 of 2024 (Tanz.) (made under section 70(1) of the Bank of Tanzania Act, Cap. 197, and published July 5, 2024), https://www.bot.go.tz/Publications/Acts,%20Regulations,%20Circulars,%20Guidelines/Regulations/en/2024092416104214.pdf [hereinafter Sandbox Regulations].
5. Ministry of Education, Science and Technology (Tanz.), National Guidelines for Artificial Intelligence in Education (Jan. 2025) [hereinafter AI in Education Guidelines].
6. The Personal Data Protection Act, No. 11 of 2022, Cap. 44, §§ 33(1)(c), 36 (Tanz.) (official English version published as G.N. No. 395B of 2023), https://media.tanzlii.org/media/legislation/376041/source_file/b6ac2610a78cbbe3/tz-act-gn-2023-395b-1-publication-document.pdf [hereinafter PDPA].
7. Konrad Zweigert & Hein Kötz, An Introduction to Comparative Law 2, 8, 34 (Tony Weir trans., 3d ed. 1998).
8. Russell & Norvig, supra note 1, at 1027–31.
9. Shoshana Zuboff, The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power 8–12 (2019).
10. Frank Pasquale, The Black Box Society: The Secret Algorithms That Control Money and Information 17–23 (2015).
11. Daniel J. Solove & Paul M. Schwartz, Information Privacy Law 45–52 (7th ed. 2021).
12. Wachter, Mittelstadt & Floridi, supra note 2, at 76–82.
13. Margot E. Kaminski, The Right to Explanation, Explained, 34 Berkeley Tech. L.J. 189 (2019); Lilian Edwards & Michael Veale, Slave to the Algorithm? Why a “Right to an Explanation” Is Probably Not the Remedy You Are Looking For, 16 Duke L. & Tech. Rev. 18 (2017).
14. Christopher Kuner, Transborder Data Flows and Data Privacy Law 22–63 (2013).
15. Greenleaf, supra note 3, at 21–23.
16. Rogier Creemers, China’s Emerging Data Protection Framework, 8 J. Cybersecurity tyac011, at 3–6 (2022), https://doi.org/10.1093/cybsec/tyac011.
17. UNESCO, The United Republic of Tanzania: Artificial Intelligence Readiness Assessment Report 20, 22 (2025), https://tanzania.un.org/sites/default/files/2025-07/National%20AI%20Readiness%20Report.pdf [hereinafter UNESCO Readiness Assessment].
18. UNESCO Readiness Assessment, supra note 17, at 24, 27.
19. PDPA, supra note 6, § 3 (definitions of “personal data” and “sensitive personal data”); Personal Information Protection Law of the People’s Republic of China (中华人民共和国个人信息保护法) (promulgated by the Standing Comm. Nat’l People’s Cong., Aug. 20, 2021, effective Nov. 1, 2021), arts. 4, 28 (China), https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm [hereinafter PIPL].
20. Constitution of the United Republic of Tanzania art. 16 (1977).
21. Alan F. Westin, Privacy and Freedom 7 (1967).
22. Constitution of the People’s Republic of China arts. 38, 40 (1982).
23. International Covenant on Civil and Political Rights, Dec. 16, 1966, 999 U.N.T.S. 171; see United Nations Treaty Collection, Status of the International Covenant on Civil and Political Rights, https://treaties.un.org/Pages/ViewDetails.aspx?src=TREATY&mtdsg_no=IV-4&chapter=4&clang=_en (recording Tanzania’s accession on June 11, 1976, and China’s signature on Oct. 5, 1998, with no ratification); Civil Code of the People’s Republic of China (中华人民共和国民法典) (promulgated by the Nat’l People’s Cong., May 28, 2020, effective Jan. 1, 2021), arts. 1032–1039 (China).
24. OECD, Recommendation of the Council Concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (Sept. 23, 1980); see PDPA, supra note 6, § 5; PIPL, supra note 19, arts. 5–9.
25. PIPL, supra note 19, arts. 28–32, 39, 55.
26. PDPA, supra note 6, § 30; Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, G.N. No. 449C of 2023, regs. 33–34 (Tanz.) (official English version), https://www.mawasiliano.go.tz/uploads/documents/sw-1691159153-GN%20NO.%20449C%20OF%202023.pdf [hereinafter Collection and Processing Regulations].
27. PIPL, supra note 19, art. 24.
28. PDPA, supra note 6, §§ 33(1)(c), 36(1)–(3); Collection and Processing Regulations, supra note 26, regs. 19, 31(e).
29. Edwards & Veale, supra note 13.
30. Generative AI Measures, supra note 3, arts. 4, 7, 9, 12, 17.
31. Provisions on the Administration of Algorithm-Generated Recommendations for Internet Information Services (互联网信息服务算法推荐管理规定) (promulgated by the Cyberspace Admin. of China, Ministry of Indus. & Info. Tech., Ministry of Pub. Sec. & State Admin. for Mkt. Regul., Dec. 31, 2021, effective Mar. 1, 2022), arts. 9, 16, 17, 24 (China), https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm.
32. Provisions on the Administration of Deep Synthesis Internet Information Services (互联网信息服务深度合成管理规定) (promulgated by the Cyberspace Admin. of China, Ministry of Indus. & Info. Tech. & Ministry of Pub. Sec., Nov. 25, 2022, effective Jan. 10, 2023), arts. 16–17 (China), https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm.
33. PIPL, supra note 19, arts. 38, 40, 60; National Cybersecurity Standardization Technical Committee, Notice on the Re-election of the National Cybersecurity Standardization Technical Committee and the Solicitation of Members (关于全国网络安全标准化技术委员会换届及征集委员的通知) (Sept. 2, 2026) (published by the Cyberspace Administration of China, Sept. 3, 2026), https://www.cac.gov.cn/2026-09/03/c_1790185079976128.htm; State Council Information Office (China), China’s Law-Based Cyberspace Governance in the New Era, panel 5 (Mar. 16, 2023), https://chinadailyhk.com/article/320928.
34. PIPL, supra note 19, arts. 38–40.
35. PDPA, supra note 6, §§ 31–32; Tenda Msinjili & Hadia Mgaya, Legal and Compliance Requirements for Cross-Border Personal Data Transfers under Tanzania’s Personal Data Protection Framework, Clyde & Co (Oct. 15, 2024), https://www.clydeco.com/en/insights/2024/10/cross-border-personal-data-transfers (describing the permit procedure under regulation 20 of the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, G.N. No. 449C of 2023); see generally Alex B. Makulilo, Myth and Reality of Harmonisation of Data Privacy Policies in Africa, 31 Computer L. & Sec. Rev. 78 (2015), https://doi.org/10.1016/j.clsr.2014.11.005.
36. Creemers, supra note 16 (concluding that the PIPL “does not create meaningful constraints on data collection and use by the state”).
37. Sandbox Regulations, supra note 4, reg. 10 (testing to be completed within twelve months of approval, extendable by the Bank); AI in Education Guidelines, supra note 5; UNESCO Readiness Assessment, supra note 17, at 39–40; see also Godbless Baluhya, A Genuine Lever or More of the Same? Tanzania’s AI Education Guidelines at a Crossroads, The Chanzo (Dar es Salaam) (May 6, 2026), https://thechanzo.com/2026/05/06/a-genuine-lever-or-more-of-the-same-tanzanias-ai-education-guidelines-at-a-crossroads.
38. PDPA, supra note 6, §§ 33(1)(c), 36; Collection and Processing Regulations, supra note 26, regs. 19(3), 31(e).
39. Sandbox Regulations, supra note 4, reg. 3 (defining “financial solution” to include digital lending, big data and data analytics, and artificial intelligence and machine learning applications); see also Zaptech Group, Building the Future: An AI-Powered Banking Ecosystem in Tanzania with Zaptech Group (Sept. 8, 2025), https://zaptechgroup.com/industry-reports/building-the-future-an-ai-powered-banking-ecosystem-in-tanzania-with-zaptech-group/ (describing the Bank of Tanzania sandbox as a platform for testing AI-driven financial products, and discussing AI credit scoring and fraud detection in Tanzanian banking).
40. Jacob Mosenda, Revealed: The AI Dilemma in Tanzanian Classrooms, The Citizen (Dar es Salaam) (May 23, 2025), https://thecitizen.co.tz/tanzania/news/national/revealed-the-ai-dilemma-in-tanzanian-classrooms-5054134; UNESCO Readiness Assessment, supra note 17, at 40 (summarising the Guidelines’ assessment and evaluation dimension, which advocates AI-driven assessment tools).
41. PDPA, supra note 6, § 7.
42. African Union Convention on Cyber Security and Personal Data Protection, June 27, 2014 (entered into force June 8, 2023); African Union, List of Countries Which Have Signed, Ratified/Acceded to the African Union Convention on Cyber Security and Personal Data Protection (July 8, 2024), https://au.int/sites/default/files/treaties/29560-sl-AFRICAN_UNION_CONVENTION_ON_CYBER_SECURITY_AND_PERSONAL_DATA_PROTECTION.pdf (recording no signature or ratification by Tanzania).
43. Generative AI Measures, supra note 3, art. 4(1) (requiring adherence to the “core socialist values”).
44. African Union, Continental Artificial Intelligence Strategy (endorsed by the Executive Council at its 45th Ordinary Session, Accra, July 18–19, 2024), https://au.int/en/documents/20240809/continental-artificial-intelligence-strategy.