Zimbabwe. Comprehensive data protection. Act
CDPACyber and Data Protection Act [Chapter 12:07] (Act 5 of 2021)
Partly verified
Medium confidence.Penalty amounts not verified. Date of assent from memory (Dec 2021).
§1Summary
- Synopsis
Zimbabwe's combined cybercrime and data protection statute, designating POTRAZ as Data Protection Authority. S.I. 155 of 2024 introduced compulsory licensing of data controllers and DPO appointments.
- Key themes
- Unique features
Controllers must obtain a POTRAZ licence in one of four tiers based on the number of data subjects (Tier 1: 50-1,000; Tier 4: over 500,000) and pay licence fees. Every controller must appoint a certified DPO, and breaches go to POTRAZ within 24 hours.
- SaaS relevance
A SaaS provider deciding purposes of processing Zimbabwean data, or processing it for commercial gain, must hold a POTRAZ licence and declare where data is stored.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- POTRAZ within 24h; data subjects within 72h if high risk
- DPO
- Yes
- Cross-border transfers
- Adequate protection; notify authority of intended transfers
§3Dates
- Key dates
- Adopted
- In force
- Cyber and Data Protection (Licensing of Data Controllers and Appointment of DPOs) Regulations, S.I. 155 of 2024, in force September 2024
§4Text and authority
- Text
- Authoritative text potraz.gov.zw
- Authority
- Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as Data Protection Authority
§5Where it applies
- Domestic law of
- Zimbabwe
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty amounts not verified. Date of assent from memory (Dec 2021).