ZimbabweCyber and Data Protection Act, sensitive, genetic, biometric and health data
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Obtain the data subject's written consent, withdrawable at any time, before processing sensitive data such as race, political opinion, religion, trade union membership, sex life, health or criminal history.
- Do not process genetic data, biometric data or health data at all unless the data subject has given written consent.
- Let a data subject withdraw consent to sensitive data processing at any time, without explanation and free of charge, and stop relying on it once they do.
- Where you rely on the not-for-profit ground in section 11(5), confine the processing to the organisation's members or regular contacts and do not disclose the data to a third party without the data subjects' consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 11 and 12 forbid processing sensitive, genetic, biometric and health data without the data subject's consent in writing, with listed exceptions. A consent required to be given in writing is a condition of processing and states no record the controller must keep. The sections name no log, audit, retention period or territorial hook.
- Kind
- None
- As of
What this law does
Section 11(1) bars a data controller from processing sensitive data unless the data subject has given consent in writing, and section 11(2) lets the data subject withdraw that consent at any time, without explanation and free of charge. Section 11(3) lets the Authority determine the circumstances in which the prohibition cannot be lifted even with consent.
Section 11(5) disapplies the consent requirement where the processing is necessary to carry out the controller's obligations and specific rights in employment law, to protect vital interests where the data subject cannot consent, in the legitimate activities of a not-for-profit body confined to its members, to comply with national security laws, for legal claims with appropriate guarantees, where the data subject has made the data public, for scientific research on the Authority's conditions, or where a law authorises it for a substantial public interest.
Section 12 bars the processing of genetic data, biometric sensitive data and health data altogether unless the data subject has given written consent. The Act commenced on , so these provisions have bound since then.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .