Zimbabwe Cyber and Data Protection Act compliance and requirements, so your data handling holds up when someone asks.

What it is

What is Zimbabwe's Cyber and Data Protection Act and what is it used for?

The Cyber and Data Protection Act [Chapter 12:07] is Zimbabwe's personal data protection law. It applies to processing and storage of data wholly or partly by automated means, including by a controller not permanently established in Zimbabwe whose means are located there, who must designate a representative.

The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is the Data Protection Authority under section 5 and receives and investigates complaints. The practical test: for any personal data you hold, could you show its purpose and basis, who was told, how it is protected and where it goes?

Current law. Printed on the regulator's site as Chapter 12:07 with the note that the Act was re-gazetted with a new title; the text gives its date of commencement as 3rd December, 2021 and it is administered with the Postal and Telecommunications Act [Chapter 12:05]. Confirm current wording and the authority's guidance with your legal advisers.

Who it is for

Who needs to comply with Zimbabwe's Cyber and Data Protection Act?

The Act reaches organisations of every size that handle personal data in Zimbabwe. Organisations usually come to Sterling for a structured programme from one of four directions:

• Any organisation that decides how personal data is used or gains commercially from it. The 2024 regulations say no one may process personal information for those purposes without a data controller licence from POTRAZ, subject to listed exemptions.
• Companies using cloud, hosting or support centres outside Zimbabwe. POTRAZ's cross-border guideline requires prior notification, an impact assessment, express consent, an adequacy showing and a data-sharing agreement before data leaves.
• Banks, insurers, telecoms and health providers handling sensitive or biometric data. Sensitive data needs written consent, and the regulations oblige controllers to notify POTRAZ of biometric and genetic processing.
• Payroll, call-centre and software providers acting as processors. Processors act only on the controller's instructions under a written contract that keeps security measures in place.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Zimbabwe Cyber and Data Protection Act requirements?

Strip away the vocabulary and Zimbabwe's Cyber and Data Protection Act requires a business to comply in six areas of personal data handling. The list below puts each one in business terms; the Act and the regulator's guidance give the full wording and exceptions.

• Hold a controller licence before processing: organisations that decide how personal data is used, or process it commercially, apply to POTRAZ for a data controller licence in the tier matching the number of people concerned.
• Process lawfully, with a purpose and consent: collect data for stated, legitimate purposes, keep it accurate and no longer than needed, and rely on consent or another allowed ground, with written consent for sensitive data.
• Tell people and respect their rights: explain who you are and why you collect data, and let people see, correct, delete and object, including to decisions made solely by automated processing.
• Secure the data and report breaches fast: use technical and organisational safeguards, bind processors by written contract, and tell POTRAZ of a breach within twenty-four hours, informing affected people where the risk is high.
• Appoint and train a data protection officer: name an officer with relevant skills who completes a POTRAZ-approved certification course, and notify POTRAZ of the appointment, any change and your processing activities.
• Control data sent outside Zimbabwe: notify POTRAZ before a transfer, assess the impact, show the destination gives adequate protection, obtain the person's express consent and sign a data-sharing agreement with the recipient.

Compliance route

How do you achieve Zimbabwe Cyber and Data Protection Act compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to POTRAZ if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, staff, users and suppliers: what is collected, for which purpose, on which basis, where it is stored, who processes it for you and whether it leaves Zimbabwe.
2. 02
   Gap analysis: compare current practice with the Act.Each area of the Act reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Complete the formalities the Act requires, rewrite notices and consent wording, put security measures and processor contracts in place, name who is responsible and agree a breach procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests, record incidents and report them as the Act requires, keep formalities current, review transfers, refresh training and follow POTRAZ's guidance as it is issued.

Check the route before you sign. The Act creates no certificate of compliance, so treat any offer of a "Zimbabwe Cyber and Data Protection Act certificate" with suspicion. If a customer wants independent assurance, ISO/IEC 27701 or ISO/IEC 27001 is certifiable by an accredited certification body; confirm the body's accreditation scope directly with the accreditation body concerned.

Cost

How much does Zimbabwe Cyber and Data Protection Act compliance cost?

The cost of a Zimbabwe Cyber and Data Protection Act programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Zimbabwe Cyber and Data Protection Act compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Zimbabwe Cyber and Data Protection Act engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Act, and the Act creates no certificate of compliance; POTRAZ supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, consent wording, request, security and breach procedures, processor contract terms and transfer documents, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Formalities support

  Help preparing the formalities the Act requires and the responsible person's role, with findings closed with evidence.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is the Data Protection Authority under section 5 and receives and investigates complaints.

Often combined with

Standards organisations pair with Cyber and Data Protection Act (Zimbabwe)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Data Privacy Act (Philippines)Philippine Data Privacy Act compliance consulting: DPO, privacy impact assessments, security and 72-hour breach handling, from our office in Manila.