Makes credit decisions, in Zimbabwe

Cyber and Data Protection Act, No. 5 of 2021, ss. 14-16, 25-26 (rights of the data subject) · Read the law's page

• Give a data subject notice of who is responsible for processing and why, and let them access, object to, correct, or have deleted false or misleading personal data about them.
• Make the disclosures section 15 requires when you collect personal information directly from the data subject.
• Do not take a decision about a data subject on the basis of automatic data processing outside what section 25 allows, and deal with a child data subject through the representation section 26 provides.

Statutory Instrument 155 of 2024, regulation 10 (children's information and automated decisions) · Read the law's page

• Obtain the consent of a parent or legal guardian before processing a child's personal information, and do not subject a child's data to automated decision-making that affects the child's rights.
• Make reasonable efforts to verify that the consent to process a child's personal information was given or authorised by the parent or legal guardian, taking available technology into account.
• Conduct regular data protection impact assessments to identify and mitigate privacy risks to children, and ensure data protection by design and by default when processing children's data.
• Do not subject any data subject to a decision based solely on automated processing which produces legal effects concerning them, without their consent or a provision established by law.