ZimbabweCyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024
Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations 2024 (Statutory Instrument 155 of 2024), licensing, the data protection officer and security (ss. 3-9 and 11-16)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Data Protection Authority (Postal and Telecommunications Regulatory Authority)
- Obligation class
- Licensing, Governance, Security, Reporting
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- Obtain a data controller licence from the Data Protection Authority before processing personal information, if you decide the means, purpose or outcome of processing, decide what data to collect or from whom, or obtain commercial gain from the processing.NIST Privacy FrameworkGV.PO-P5
- Appoint a certified data protection officer and notify the Authority of the appointment in writing.NIST Privacy FrameworkGV.PO-P3NIST Privacy FrameworkGV.PO-P5
- Notify the Authority of your processing activities, any intended cross-border transfer of personal data, and any processing of biometric or genetic data.NIST Privacy FrameworkGV.PO-P5
- Appoint the data protection officer within ninety days of the Regulations' promulgation or of a contract ending, and tell the Authority in writing within fourteen days of any change to the officer's number, email address or physical address, or of their dismissal or resignation.NIST Privacy FrameworkGV.PO-P3NIST Privacy FrameworkGV.PO-P5
- Process personal data securely by appropriate technical and organisational measures, including risk assessments, organisational policies, physical and technical measures across all data phases, and processes to test how effective they are and to make the improvements they show are needed.NIST Privacy FrameworkPR.DS-P5
- Give your data protection officer continuous professional development training so their certification is maintained.NIST Privacy FrameworkGV.AT-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.AT-P3Privacy personnel understand their roles and responsibilities.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Processing personal information without a data controller licence (s. 3(3)), continuing to process after the six-month transition period without a licence (s. 4(6)), submitting false information in a licence application (s. 7), contravening a data controller's obligations under s. 10, contravening the security-of-data duties of s. 16, or contravening the breach-notification duties of s. 17, are each an offence liable to a fine not exceeding level 11 or imprisonment not exceeding seven years, or both. Failing to appoint a data protection officer under s. 12(1) carries a lighter penalty of a fine not exceeding level 7 or imprisonment not exceeding two years, or both. Fines are expressed by level on the Criminal Law Code's standard scale rather than in a stated currency amount.
What it makes you log
Logging duty
Regulations 3 to 9 and 11 to 16 license data controllers, require a data protection officer and notice of the appointment to the Authority, set the officer's qualifications and functions, and require approval of codes and secure processing. Licence applications, notices of an officer's appointment and the Authority's registers are filings and registers the Authority keeps, and a written policy or a risk assessment programme states rules rather than a record of processing. No provision in these regulations requires the controller to keep a log or record, to retain one for a period, or to make one available. Regulation 14(a)(iv) gives the officer the function of conducting internal compliance audits, with no cadence. The record of personal data breaches is in regulation 17(4)(b) and the children's impact assessments in regulation 10(5)(d), which other rows cover. The regulations bind any person who processes personal information and name no territorial hook.
- Kind
- None
- As of
What this law does
Regulation 3(1) bars any person from processing personal information for the purposes regulation 3(2) lists unless licensed with the Authority, and regulation 3(2) catches anyone who processes personal information intending to decide the means, purpose or outcome of the processing, to decide what personal data should be collected, to decide which individuals to collect it from, or to obtain commercial gain or other benefit from it.
Regulation 4 requires a written application in Form DP1, regulation 6 tiers the licence by the number of data subjects processed, and regulations 8 and 9 set the exemptions and the register of licensed controllers.
Regulation 10(1) requires continuous professional development training for the data protection officer, regulation 10(2) requires the Authority to be notified of all processing activities, of any modification of personal information collected indirectly, of any intention to transfer or share a data subject's information outside Zimbabwe, and of any processing involving biometric and genetic data, and regulation 10(4) makes the controller accountable for its representatives and processors and requires appropriate technical and organisational measures and a written data processing agreement.
Regulation 12 requires a data protection officer to be appointed and the Authority notified in Form DP2, within ninety days of the Regulations' promulgation or of a contract ending, with any change of the officer's contact details or their dismissal or resignation notified within fourteen days.
Regulation 16 requires personal data to be processed securely by appropriate technical and organisational measures, including risk assessments, organisational policies, physical and technical measures across all data phases, and processes to test their effectiveness.
The Regulations were made by the Minister of Information Communications Technology, Postal and Courier Services in consultation with the Authority under section 32 of the Cyber and Data Protection Act, and took effect on their publication on .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .