ZimbabweCyber and Data Protection Regulations 2024, security breach notification
Statutory Instrument 155 of 2024, regulation 17 (security breach notification)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Report a personal data breach to the Authority within 24 hours of becoming aware of it, on Form DP3 in the Fourth Schedule.NIST Privacy FrameworkCM.AW-P7
- Inform the affected data subjects within 72 hours where the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms.NIST Privacy FrameworkCM.AW-P7
- Keep robust breach detection, investigation and internal reporting procedures in place, and keep a record of all personal data breaches.NIST Privacy FrameworkPR.PO-P7
- Answer the Authority's information request about a data breach within 14 days of that request, and cooperate with its enquiries or investigations.NIST Privacy FrameworkGV.PO-P5
- Finish the data breach investigation and submit your report within 21 days from the date of notification.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- RS.AN-03Analysis is performed to establish what has taken place during an incident and the root cause of the incident
- RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.CO-03Information is shared with designated internal and external stakeholders
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Regulation 17(4)(b) requires the controller to keep a record of all personal data breaches, whether or not they are notified. The regulation does not list what the record holds and sets no retention period, so the contents are left empty and no retention is coded. Regulation 17(5)(b) requires the controller to answer the Authority's information requests on breaches within fourteen days, and 17(5)(c) requires an investigation report to be submitted within twenty-one days of notification; that report is the controller's own incident report, not an audit. The regulation names no territorial hook.
- Kind
- Explicit
- As of
- Provision
- Regulation 17(4)(b) (a record of all personal data breaches), with regulation 17(5)(b)
- Trigger
- security_incident
What this law does
Regulation 17(1) requires a data controller to report a personal data breach to the Authority within 24 hours of becoming aware of the breach affecting the data being processed by it or by its data processor, and regulation 17(2) requires the report to be made on Form DP3 in the Fourth Schedule.
Regulation 17(3) requires the controller also to inform the affected data subjects within 72 hours where the detected breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms. Regulation 17(4) requires robust breach detection, investigation and internal reporting procedures and a record of all personal data breaches.
Regulation 17(5) requires the controller to cooperate with the Authority's enquiries or investigations, to answer an information request on a data breach within fourteen days, and to conclude the investigation and submit a report within twenty-one days from the date of notification. Regulation 17(6) makes contravening the regulation an offence.
The Regulations were made by the Minister of Information Communications Technology, Postal and Courier Services in consultation with the Authority under section 32 of the Cyber and Data Protection Act, and took effect on their publication on .
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .