ZimbabweCyber and Data Protection Act [Chapter 12:07]
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Security, Governance, Disclosure
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Process personal data necessarily, fairly, lawfully and for specified, legitimate purposes before a crawler or AI training pipeline collects or uses personal data of a person in Zimbabwe.NIST Privacy FrameworkGV.PO-P1
- Notify the Authority before any wholly or partly automated processing operation, and notify it again of any modification to the information you gave.NIST Privacy FrameworkGV.PO-P5
- State in that notification the date and the instrument permitting the processing, who you are, what the processing is called and what it is for, the categories of data and of data subjects, the safeguards on disclosure to third parties, how data subjects are informed and can exercise access, any linked processing, the retention period, an assessment of whether your security measures are adequate, any data processor you use, and the transfers you plan.NIST Privacy FrameworkGV.PO-P5
- Notify the Authority of the appointment of your data protection officer, and have the officer ensure compliance, handle requests made to you and work with the Authority.NIST Privacy FrameworkGV.PO-P3
- Take the security measures section 18 requires, keep your processing open as section 23 requires, and be accountable for it as section 24 requires.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkCM.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CM.PO-P1Transparency policies, processes, and procedures for communicating data processing purposes, practices, and associated privacy risks are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator, Data subject
Logging duty
Section 24(1)(b) obliges the controller to keep internal mechanisms for demonstrating compliance to data subjects and to the Authority in the exercise of its powers, which cannot be met without records of the processing. The Act names no log, no content for a record and no period. Registration particulars filed with the Authority (the notification and its register) are a filing, not a record the controller keeps. The territorial rule in section 4(2) is not among the sections this row cites; its second prong turns on where the means of processing are located and carries no hook value, and its first prong names no territory. The Act's only mention of traffic data is in the definition of data, and no traffic-data retention clause appears in the text read.
- Kind
- Implicit
- As of
- Provision
- Section 24(1)(b) (accountability), with the Authority's inspection power in the section on the content of notification
- Trigger
- personal_data_processing
What this law does
Section 8 requires personal information to be processed necessarily, fairly and lawfully, and section 9 requires it to be collected for specified and legitimate purposes. Section 10 governs non-sensitive data. Section 13 sets the duties of the data controller and section 15 the disclosures owed when data is collected directly from the data subject. Section 17 fixes the authority to process and section 18 the security of processing.
Section 20 requires the controller to notify the Authority before any wholly or partly automated operation, to notify any modification of the information given, and to notify the appointment of a data protection officer, and lets the Authority exempt categories where there is no apparent risk to data subjects' rights or where an officer has been appointed.
Section 21 fixes the thirteen items the notification must state and lets the Authority inspect and assess the security and organisational measures before the processing or transfer begins. Section 23 requires openness of processing and section 24 accountability. The Act commenced on , so these provisions have bound since then.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes personal data.
Back to the example · Lint your app
Page updated .