Processes biometric data, in Zimbabwe

Cyber and Data Protection Act, No. 5 of 2021, ss. 11-12 (sensitive information and genetic, biometric and health data) · Read the law's page

• Obtain the data subject's written consent, withdrawable at any time, before processing sensitive data such as race, political opinion, religion, trade union membership, sex life, health or criminal history.
• Do not process genetic data, biometric data or health data at all unless the data subject has given written consent.
• Let a data subject withdraw consent to sensitive data processing at any time, without explanation and free of charge, and stop relying on it once they do.
• Where you rely on the not-for-profit ground in section 11(5), confine the processing to the organisation's members or regular contacts and do not disclose the data to a third party without the data subjects' consent.

Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024), licensing, the data protection officer and security (ss. 3-9 and 11-16) · Read the law's page

• Obtain a data controller licence from the Data Protection Authority before processing personal information, if you decide the means, purpose or outcome of processing, decide what data to collect or from whom, or obtain commercial gain from the processing.
• Appoint a certified data protection officer and notify the Authority of the appointment in writing.
• Notify the Authority of your processing activities, any intended cross-border transfer of personal data, and any processing of biometric or genetic data.
• Appoint the data protection officer within ninety days of the Regulations' promulgation or of a contract ending, and tell the Authority in writing within fourteen days of any change to the officer's number, email address or physical address, or of their dismissal or resignation.
• Process personal data securely by appropriate technical and organisational measures, including risk assessments, organisational policies, physical and technical measures across all data phases, and processes to test how effective they are and to make the improvements they show are needed.
• Give your data protection officer continuous professional development training so their certification is maintained.