Processes personal data, in Zimbabwe

Cyber and Data Protection Act, No. 5 of 2021 (Zimbabwe), general duties (ss. 8-10, 13, 15-18 and 20-27) · Read the law's page

• Process personal data necessarily, fairly, lawfully and for specified, legitimate purposes before a crawler or AI training pipeline collects or uses personal data of a person in Zimbabwe.
• Notify the Authority before any wholly or partly automated processing operation, and notify it again of any modification to the information you gave.
• State in that notification the date and the instrument permitting the processing, who you are, what the processing is called and what it is for, the categories of data and of data subjects, the safeguards on disclosure to third parties, how data subjects are informed and can exercise access, any linked processing, the retention period, an assessment of whether your security measures are adequate, any data processor you use, and the transfers you plan.
• Notify the Authority of the appointment of your data protection officer, and have the officer ensure compliance, handle requests made to you and work with the Authority.
• Take the security measures section 18 requires, keep your processing open as section 23 requires, and be accountable for it as section 24 requires.

Cyber and Data Protection Act, No. 5 of 2021, s. 19 (security breach notification) · Read the law's page

• As a data controller, notify the Data Protection Authority within 24 hours of any security breach affecting data you process (section 19).
• Treat every security breach affecting the data you process as notifiable under section 19: the Act sets no risk threshold below which the duty falls away.

Cyber and Data Protection Act, No. 5 of 2021, ss. 11-12 (sensitive information and genetic, biometric and health data) · Read the law's page

• Obtain the data subject's written consent, withdrawable at any time, before processing sensitive data such as race, political opinion, religion, trade union membership, sex life, health or criminal history.
• Do not process genetic data, biometric data or health data at all unless the data subject has given written consent.
• Let a data subject withdraw consent to sensitive data processing at any time, without explanation and free of charge, and stop relying on it once they do.
• Where you rely on the not-for-profit ground in section 11(5), confine the processing to the organisation's members or regular contacts and do not disclose the data to a third party without the data subjects' consent.

Cyber and Data Protection Act, No. 5 of 2021, ss. 14-16, 25-26 (rights of the data subject) · Read the law's page

• Give a data subject notice of who is responsible for processing and why, and let them access, object to, correct, or have deleted false or misleading personal data about them.
• Make the disclosures section 15 requires when you collect personal information directly from the data subject.
• Do not take a decision about a data subject on the basis of automatic data processing outside what section 25 allows, and deal with a child data subject through the representation section 26 provides.

Cyber and Data Protection Act, No. 5 of 2021, ss. 28-29 (transfer outside Zimbabwe) · Read the law's page

• Before transferring personal data outside Zimbabwe, confirm an adequate level of protection exists in the recipient's country or that the transfer is solely to carry out tasks within your competence as controller.
• Assess adequacy on all the circumstances before the transfer, weighing the nature of the data, the purpose and duration of the processing, who the recipient is, the data protection laws in force there, and the professional rules and security measures complied with.
• Check the categories and circumstances the Authority has laid down as not authorised before transferring personal information out of Zimbabwe.

Cyber and Data Protection Act, No. 5 of 2021, ss. 5-7, 30-34 (the Authority, offences and appeals) · Read the law's page

• Expect the Postal and Telecommunications Regulatory Authority, acting as the Data Protection Authority, to supervise your processing, and expect a right of appeal against its decision under section 34.
• Note that contravening the sensitive-data rule in section 11, the controller's duties in section 13, section 18(4), accountability in section 24 or the transfer rule in section 28 is an offence carrying a fine up to level 11 or up to seven years' imprisonment, or both.
• Note that on conviction a court may order the seizure of the media holding the data the offence relates to, or its deletion.

Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024), licensing, the data protection officer and security (ss. 3-9 and 11-16) · Read the law's page

• Obtain a data controller licence from the Data Protection Authority before processing personal information, if you decide the means, purpose or outcome of processing, decide what data to collect or from whom, or obtain commercial gain from the processing.
• Appoint a certified data protection officer and notify the Authority of the appointment in writing.
• Notify the Authority of your processing activities, any intended cross-border transfer of personal data, and any processing of biometric or genetic data.
• Appoint the data protection officer within ninety days of the Regulations' promulgation or of a contract ending, and tell the Authority in writing within fourteen days of any change to the officer's number, email address or physical address, or of their dismissal or resignation.
• Process personal data securely by appropriate technical and organisational measures, including risk assessments, organisational policies, physical and technical measures across all data phases, and processes to test how effective they are and to make the improvements they show are needed.
• Give your data protection officer continuous professional development training so their certification is maintained.

Statutory Instrument 155 of 2024, regulation 17 (security breach notification) · Read the law's page

• Report a personal data breach to the Authority within 24 hours of becoming aware of it, on Form DP3 in the Fourth Schedule.
• Inform the affected data subjects within 72 hours where the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms.
• Keep robust breach detection, investigation and internal reporting procedures in place, and keep a record of all personal data breaches.
• Answer the Authority's information request about a data breach within 14 days of that request, and cooperate with its enquiries or investigations.
• Finish the data breach investigation and submit your report within 21 days from the date of notification.