ZimbabweCyber and Data Protection Act, rights of the data subject
Cyber and Data Protection Act, No. 5 of 2021, ss. 14-16, 25-26 (rights of the data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a data subject notice of who is responsible for processing and why, and let them access, object to, correct, or have deleted false or misleading personal data about them.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Make the disclosures section 15 requires when you collect personal information directly from the data subject.NIST Privacy FrameworkCM.AW-P1
- Do not take a decision about a data subject on the basis of automatic data processing outside what section 25 allows, and deal with a child data subject through the representation section 26 provides.NIST Privacy FrameworkCT.DM-P10
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 14 to 16, 25 and 26 give the data subject rights (information, access, objection, correction, deletion, no solely automated decision) and set the disclosures a controller makes. A right to access one's own personal information is access to the data, not to a log, and none of these sections requires a record, an audit or a retention period. They name no territorial hook.
- Kind
- None
- As of
What this law does
Section 14 gives a data subject the right to be informed of the use to which their personal information is to be put, to access the personal information a data controller or data processor holds about them, to object to the processing of all or part of it, to have false or misleading personal information corrected, and to have false or misleading data about them deleted.
Sections 15 and 16 fix the disclosures owed when data is collected directly from the data subject and the information the controller must hold. Section 25 governs a decision taken on the basis of automatic data processing, and section 26 the representation of a data subject who is a child. The Act commenced on , so these provisions have bound since then.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .