LexLint.ioBeta

Know the law your code answers to.

Law / Zimbabwe

Cyber and Data Protection Act, transfer of personal information outside Zimbabwe

Cyber and Data Protection Act, No. 5 of 2021, ss. 28-29 (transfer outside Zimbabwe)

In force since .

A cross border transfer rule binding public and private bodies.

Obligation class
Transfer
Audit expectation
none

What it requires

  • Before transferring personal data outside Zimbabwe, confirm an adequate level of protection exists in the recipient's country or that the transfer is solely to carry out tasks within your competence as controller.
  • Assess adequacy on all the circumstances before the transfer, weighing the nature of the data, the purpose and duration of the processing, who the recipient is, the data protection laws in force there, and the professional rules and security measures complied with.
  • Check the categories and circumstances the Authority has laid down as not authorised before transferring personal information out of Zimbabwe.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
FINOS AIGF

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Section 28 bars a transfer of personal information to a foreign recipient unless the recipient country ensures an adequate level of protection, which is assessed in the light of all the circumstances, and section 29 lists the cases where a transfer to a country without adequacy may proceed, including the data subject's unambiguous consent. Neither section requires the assessment or the consent to be recorded, and neither names a log, an audit, a retention period or a territorial hook.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 28(1) bars a data controller from transferring personal information about a data subject to a third party in a foreign country unless an adequate level of protection is ensured in the recipient's country or within the recipient international organisation, and unless the data is transferred solely to allow tasks covered by the controller's competence to be carried out.

Section 28(2) makes adequacy a question of all the circumstances, weighing the nature of the data, the purpose and duration of the proposed processing, the recipient, the data protection laws in force there, and the professional rules and security measures complied with. Section 28(3) lets the Authority lay down the categories of processing operations and the circumstances in which a transfer out of Zimbabwe is not authorised.

Section 29 governs a transfer to a country that does not assure an adequate level of protection. The Act commenced on , so these provisions have bound since then.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .