Zimbabwe

Zimbabwe regulates personal data through the Cyber and Data Protection Act [Chapter 12:07] (No. 5 of 2021), gazetted on 3 December 2021 and in operation from 11 March 2022. The Act is a dual-purpose instrument, consolidating both personal data protection and cybercrime within a single statute. It applies to controllers processing personal data in Zimbabwe and to controllers outside the country where the means used for processing are situated within it. Controllers must process data fairly and lawfully, collect for specified and legitimate purposes, ensure accuracy, and implement appropriate security measures. Data subjects hold rights of access, correction, deletion, and objection. The Act imposes a notably short breach-notification window, controllers must notify the Data Protection Authority within 24 hours of discovery, stricter than the 72-hour norm elsewhere, and establishes special protections for sensitive categories including health, biometric, and religious or political-belief data. Cross-border transfers are restricted to jurisdictions providing adequate protection. The framework was significantly built out in September 2024 by the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024, which introduced mandatory registration and licensing of data controllers (12-month renewable licences) and required the appointment of data protection officers. Institutionally, rather than create an independent regulator, the Act designates the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the Data Protection Authority. POTRAZ maintains the register of controllers, enforces fair processing, investigates complaints, advises the Minister, and facilitates cross-border cooperation. With a primary Act, 2024 licensing regulations, and a designated, active authority, Zimbabwe has a working, in-force regime, albeit one where data protection is supervised by the telecoms regulator.