LexLint.ioBeta

Know the law your code answers to.

Law / Zimbabwe

Cyber and Data Protection Act, security breach notification

Cyber and Data Protection Act, No. 5 of 2021, s. 19 (security breach notification)

In force since .

A breach notification rule binding public and private bodies.

Obligation class
Breach notice, Reporting
Audit expectation
none

What it requires

  • As a data controller, notify the Data Protection Authority within 24 hours of any security breach affecting data you process (section 19).
  • Treat every security breach affecting the data you process as notifiable under section 19: the Act sets no risk threshold below which the duty falls away.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
FINOS AIGF

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Section 19 requires only that the controller notify the Authority within twenty-four hours of a security breach. It names no record of the breach, no audit and no access to a record. The duty to keep a record of every personal data breach sits in regulation 17(4)(b) of the 2024 Regulations, which this row does not cite and so does not borrow. The section has no scope clause.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 19 requires the data controller to notify the Authority within twenty-four hours of any security breach affecting data he or she processes. The section attaches the duty to any security breach affecting the data, with no risk threshold below which it falls away and no separate duty to the data subject; the duty to tell an affected data subject comes from regulation 17(3) of the 2024 Regulations instead, on its own separate period. The Act commenced on , so these provisions have bound since then.

When LexLint raises it

When your app profile says your app runs an essential service or processes personal data.

Back to the example  ·  Lint your app

Page updated .