Handles health records, in Zimbabwe

Cyber and Data Protection Act, No. 5 of 2021, ss. 11-12 (sensitive information and genetic, biometric and health data) · Read the law's page

• Obtain the data subject's written consent, withdrawable at any time, before processing sensitive data such as race, political opinion, religion, trade union membership, sex life, health or criminal history.
• Do not process genetic data, biometric data or health data at all unless the data subject has given written consent.
• Let a data subject withdraw consent to sensitive data processing at any time, without explanation and free of charge, and stop relying on it once they do.
• Where you rely on the not-for-profit ground in section 11(5), confine the processing to the organisation's members or regular contacts and do not disclose the data to a third party without the data subjects' consent.