ZimbabweCyber and Data Protection Act, Insertion of Computer-Misuse Offences into the Criminal Law Code
Cyber and Data Protection Act [Chapter 12:07] (No. 5 of 2021) s. 35, substituting ss. 163-166 of the Criminal Law (Codification and Reform) Act [Chapter 9:23]
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- Access restriction, Prohibition, Security
- Audit expectation
- none
What it requires
- Do not access data, a computer programme, or a computer system if you know or suspect you must obtain prior authority to access it and have not obtained that authority.NIST AI RMFMAP 4.1
- Do not intercept a private data transmission, overcome or circumvent a protective security measure, or acquire data within or transmitted to or from a computer system without lawful authority.NIST AI RMFMAP 4.1
- Do not damage, delete, alter, or block access to computer data, or interfere with the functioning of a computer or information system, without lawful authority.no control in the NIST AI RMF
- Do not communicate, disclose, or use an access code, password, or programme designed to gain unauthorised access to data or a computer system.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 163 (Hacking): a fine not exceeding level 10 or imprisonment not exceeding five years, or both, rising to level 14 or imprisonment not exceeding ten years in aggravating circumstances defined in section 163F. Section 163A (Unlawful acquisition of data): a fine not exceeding level 14 or imprisonment not exceeding five years, or both, rising to ten years aggravated; unlawful possession of unlawfully acquired data carries the same penalty. Section 163B (Unlawful interference with data): a fine not exceeding level 10 or imprisonment not exceeding five years, or both, rising to level 14 or ten years aggravated. Section 163C (Unlawful interference with a computer system): a fine not exceeding level 14 or imprisonment not exceeding ten years, or both, rising to twenty years aggravated. Section 163D (Unlawful disclosure of a data code): a fine not exceeding level 12 or imprisonment not exceeding ten years, or both (ten years where the data forms part of a database or involves national security or an essential service). Section 163E (Unlawful use of data or devices): a fine not exceeding level 12 or imprisonment not exceeding ten years, or both, for acquiring or supplying an access-defeating code or programme, and a fine not exceeding level 10 or imprisonment not exceeding five years, or both, for assembling or using malicious software, each rising to level 12 or ten years aggravated. Fines are expressed by level on the Criminal Law Code's standard scale rather than in a stated currency amount.
Who enforces it
Enforcement body
Zimbabwe Republic Police and the courts, under the Criminal Law (Codification and Reform) Act [Chapter 9:23]
What it makes you log
Logging duty
Section 35 of the Cyber and Data Protection Act substitutes sections 163 to 166 of the Criminal Law (Codification and Reform) Act: hacking (163), unlawful acquisition of data (163A), unlawful interference with data and with a computer system (163B and 163C), and the related device and jurisdiction provisions. None of them requires anyone to create, keep, produce or review a log or record. Section 166 gives a court in Zimbabwe jurisdiction where the offence was committed in part in Zimbabwe, by a person carrying on business there, or by anyone abroad where the conduct is an offence where committed and harmful effects were caused in Zimbabwe; the jurisdiction limbs that turn on where the computer or data is located, and the limb for a national or permanent resident alone, carry no hook value. Outside the cited sections, section 36 inserts sections 379A and 379B into the Criminal Procedure and Evidence Act, under which a police officer may require a person in control of data to preserve it for up to seven days (extendable by a magistrate) and a magistrate may order traffic data to be collected, recorded or preserved; the row cites only section 35, so none of that is coded.
- Kind
- None
- As of
What this law does
Section 163 (Hacking) makes it an offence for a person who knows or suspects they must obtain prior authority to access data, a computer programme, a data storage medium, or a computer system, to intentionally and unlawfully secure access without that authority, liable to a fine not exceeding level 10 or imprisonment not exceeding five years, or both, rising to level 14 or ten years in aggravating circumstances.
Section 163A (Unlawful acquisition of data) penalises intercepting a private data transmission, overcoming or circumventing a protective security measure to prevent access, or acquiring data within or transmitted to or from a computer system, at a fine not exceeding level 14 or imprisonment not exceeding five years, or both (ten years aggravated); possessing data known to have been unlawfully acquired is a separate, identically punished offence.
Section 163B (Unlawful interference with data or a data storage medium) and section 163C (Unlawful interference with a computer system) penalise damaging, deleting, altering, blocking access to, or otherwise interfering with computer data or the functioning of a computer or information system, at up to level 10 or five years for data interference (level 14 or ten years aggravated) and up to level 14 or ten years for system interference (twenty years aggravated).
Section 163D (Unlawful disclosure of a data code) penalises communicating an access code or password to a person not authorised to use it, or creating, altering or destroying such a code, at a fine not exceeding level 12 or imprisonment not exceeding ten years, or both, unless the act is authorised by law.
Section 163E (Unlawful use of data or devices) penalises acquiring, possessing, or supplying an access code, password, or programme designed to commit an offence under the Act, at up to level 12 or ten years, and assembling or using malicious software to damage data or systems, at up to level 10 or five years (level 12 or ten years aggravated).
None of these sections defines "unlawfully" or "authority" by reference to a public, unauthenticated web page; each turns on whether the accused knew or suspected they lacked authority, or overcame a protective security measure, to access or acquire the data.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .