Duty LXD-7197
Runs an essential service, in Zimbabwe
Cyber and Data Protection Act, security breach notificationsince 2 lines
Cyber and Data Protection Act, No. 5 of 2021, s. 19 (security breach notification) · Read the law's page
- As a data controller, notify the Data Protection Authority within 24 hours of any security breach affecting data you process (section 19).
- Treat every security breach affecting the data you process as notifiable under section 19: the Act sets no risk threshold below which the duty falls away.
Cyber and Data Protection Regulations 2024, security breach notificationsince 5 lines
Statutory Instrument 155 of 2024, regulation 17 (security breach notification) · Read the law's page
- Report a personal data breach to the Authority within 24 hours of becoming aware of it, on Form DP3 in the Fourth Schedule.
- Inform the affected data subjects within 72 hours where the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms.
- Keep robust breach detection, investigation and internal reporting procedures in place, and keep a record of all personal data breaches.
- Answer the Authority's information request about a data breach within 14 days of that request, and cooperate with its enquiries or investigations.
- Finish the data breach investigation and submit your report within 21 days from the date of notification.