ZimbabweCyber and Data Protection Act, the Authority, offences and appeals
Cyber and Data Protection Act, No. 5 of 2021, ss. 5-7, 30-34 (the Authority, offences and appeals)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Postal and Telecommunications Regulatory Authority, acting as the Data Protection Authority, to supervise your processing, and expect a right of appeal against its decision under section 34.
- Note that contravening the sensitive-data rule in section 11, the controller's duties in section 13, section 18(4), accountability in section 24 or the transfer rule in section 28 is an offence carrying a fine up to level 11 or up to seven years' imprisonment, or both.
- Note that on conviction a court may order the seizure of the media holding the data the offence relates to, or its deletion.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 33(2): a data controller, representative, agent or assignee who contravenes section 11 (sensitive data consent), section 13 (duties of controller), section 18(4) (security), section 24 (accountability) or section 28 (transborder transfer) is guilty of an offence, liable to a fine not exceeding level 11 or imprisonment not exceeding seven years, or both. Section 33(1): a member of staff of the Authority, or an expert, contractor or sub-contractor, who violates the Act is liable to a fine not exceeding level 7 or imprisonment not exceeding two years, or both. Fines are expressed on the Criminal Law Code's standard scale of fines by level rather than in a stated currency amount.
Who enforces it
Enforcement body
Postal and Telecommunications Regulatory Authority, designated as Zimbabwe's Data Protection Authority
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 5 to 7 and 30 to 34 designate the Authority, state its functions, set the quality of data, provide for codes of conduct and whistle-blowing, and create the offences and the appeal. Section 6(1)(f) lets the Authority request disclosure of any documents useful to an inquiry or investigation, a power to demand information that names no record the controller must keep. The row's other provisions impose no log or record duty. The territorial rule in section 4(2) is not among the cited sections.
- Kind
- None
- As of
What this law does
Section 5 designates the Postal and Telecommunications Regulatory Authority as the Data Protection Authority and section 6 sets its functions. Section 30 provides for a code of conduct and section 31 for whistleblowers, and section 32 is the regulation-making power the 2024 Licensing Regulations were made under.
Section 33(1) makes a member of the Authority's staff, or an expert, contractor or sub-contractor, who violates the Act liable to a fine not exceeding level 7 or imprisonment not exceeding two years or both, and section 33(2) makes a data controller, representative, agent or assignee who contravenes section 11, 13, 18(4), 24 or 28 liable to a fine not exceeding level 11 or imprisonment not exceeding seven years or both.
On conviction the court may order the seizure of the media holding the data or its deletion. Section 34 gives any person aggrieved by a decision of the Authority a right of appeal. The Act commenced on , so these provisions have bound since then.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .