Zimbabwe's comprehensive personal-data statute is the Cyber and Data Protection Act [Chapter 12:07] (Act No. 5 of 2021), which commenced on and was re-gazetted with its new title on , and which designates the Postal and Telecommunications Regulatory Authority as the Data Protection Authority and binds any data controller or processor using automated or non-automated means in Zimbabwe to process personal data lawfully, fairly and transparently, with heightened consent duties for sensitive data and for genetic, biometric and health data.
Delegated legislation, the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024), requires a data controller to be licensed and to appoint a certified data protection officer, and sets a 24-hour breach notification duty to the Authority and a 72-hour duty to affected data subjects for high-risk breaches.
Enforcement combines criminal fines and imprisonment on a fine-level scale (level 7 to level 11 depending on the provision) with no express private civil right of action located in the text reviewed. Cross-border transfer requires an adequate level of protection in the recipient country or organisation, a moderate rather than a localisation-style restriction.
Section 19 requires the data controller to notify the Authority within twenty-four hours of any security breach affecting data he or she processes. The section attaches the duty to any security breach affecting the data, with no risk threshold below which it falls away and no separate duty to the data subject; the duty to tell an affected data subject comes from regulation 17(3) of the 2024 Regulations instead, on its own separate period. The Act commenced on , so these provisions have bound since then.
Regulation 17(1) requires a data controller to report a personal data breach to the Authority within 24 hours of becoming aware of the breach affecting the data being processed by it or by its data processor, and regulation 17(2) requires the report to be made on Form DP3 in the Fourth Schedule.
Regulation 17(3) requires the controller also to inform the affected data subjects within 72 hours where the detected breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms. Regulation 17(4) requires robust breach detection, investigation and internal reporting procedures and a record of all personal data breaches.
Regulation 17(5) requires the controller to cooperate with the Authority's enquiries or investigations, to answer an information request on a data breach within fourteen days, and to conclude the investigation and submit a report within twenty-one days from the date of notification. Regulation 17(6) makes contravening the regulation an offence.
The Regulations were made by the Minister of Information Communications Technology, Postal and Courier Services in consultation with the Authority under section 32 of the Cyber and Data Protection Act, and took effect on their publication on .
Section 8 requires personal information to be processed necessarily, fairly and lawfully, and section 9 requires it to be collected for specified and legitimate purposes. Section 10 governs non-sensitive data. Section 13 sets the duties of the data controller and section 15 the disclosures owed when data is collected directly from the data subject. Section 17 fixes the authority to process and section 18 the security of processing.
Section 20 requires the controller to notify the Authority before any wholly or partly automated operation, to notify any modification of the information given, and to notify the appointment of a data protection officer, and lets the Authority exempt categories where there is no apparent risk to data subjects' rights or where an officer has been appointed.
Section 21 fixes the thirteen items the notification must state and lets the Authority inspect and assess the security and organisational measures before the processing or transfer begins. Section 23 requires openness of processing and section 24 accountability. The Act commenced on , so these provisions have bound since then.
Section 28(1) bars a data controller from transferring personal information about a data subject to a third party in a foreign country unless an adequate level of protection is ensured in the recipient's country or within the recipient international organisation, and unless the data is transferred solely to allow tasks covered by the controller's competence to be carried out.
Section 28(2) makes adequacy a question of all the circumstances, weighing the nature of the data, the purpose and duration of the proposed processing, the recipient, the data protection laws in force there, and the professional rules and security measures complied with. Section 28(3) lets the Authority lay down the categories of processing operations and the circumstances in which a transfer out of Zimbabwe is not authorised.
Section 29 governs a transfer to a country that does not assure an adequate level of protection. The Act commenced on , so these provisions have bound since then.
Section 14 gives a data subject the right to be informed of the use to which their personal information is to be put, to access the personal information a data controller or data processor holds about them, to object to the processing of all or part of it, to have false or misleading personal information corrected, and to have false or misleading data about them deleted.
Sections 15 and 16 fix the disclosures owed when data is collected directly from the data subject and the information the controller must hold. Section 25 governs a decision taken on the basis of automatic data processing, and section 26 the representation of a data subject who is a child. The Act commenced on , so these provisions have bound since then.
Regulation 3(1) bars any person from processing personal information for the purposes regulation 3(2) lists unless licensed with the Authority, and regulation 3(2) catches anyone who processes personal information intending to decide the means, purpose or outcome of the processing, to decide what personal data should be collected, to decide which individuals to collect it from, or to obtain commercial gain or other benefit from it.
Regulation 4 requires a written application in Form DP1, regulation 6 tiers the licence by the number of data subjects processed, and regulations 8 and 9 set the exemptions and the register of licensed controllers.
Regulation 10(1) requires continuous professional development training for the data protection officer, regulation 10(2) requires the Authority to be notified of all processing activities, of any modification of personal information collected indirectly, of any intention to transfer or share a data subject's information outside Zimbabwe, and of any processing involving biometric and genetic data, and regulation 10(4) makes the controller accountable for its representatives and processors and requires appropriate technical and organisational measures and a written data processing agreement.
Regulation 12 requires a data protection officer to be appointed and the Authority notified in Form DP2, within ninety days of the Regulations' promulgation or of a contract ending, with any change of the officer's contact details or their dismissal or resignation notified within fourteen days.
Regulation 16 requires personal data to be processed securely by appropriate technical and organisational measures, including risk assessments, organisational policies, physical and technical measures across all data phases, and processes to test their effectiveness.
The Regulations were made by the Minister of Information Communications Technology, Postal and Courier Services in consultation with the Authority under section 32 of the Cyber and Data Protection Act, and took effect on their publication on .
Section 5 designates the Postal and Telecommunications Regulatory Authority as the Data Protection Authority and section 6 sets its functions. Section 30 provides for a code of conduct and section 31 for whistleblowers, and section 32 is the regulation-making power the 2024 Licensing Regulations were made under.
Section 33(1) makes a member of the Authority's staff, or an expert, contractor or sub-contractor, who violates the Act liable to a fine not exceeding level 7 or imprisonment not exceeding two years or both, and section 33(2) makes a data controller, representative, agent or assignee who contravenes section 11, 13, 18(4), 24 or 28 liable to a fine not exceeding level 11 or imprisonment not exceeding seven years or both.
On conviction the court may order the seizure of the media holding the data or its deletion. Section 34 gives any person aggrieved by a decision of the Authority a right of appeal. The Act commenced on , so these provisions have bound since then.
Section 11(1) bars a data controller from processing sensitive data unless the data subject has given consent in writing, and section 11(2) lets the data subject withdraw that consent at any time, without explanation and free of charge. Section 11(3) lets the Authority determine the circumstances in which the prohibition cannot be lifted even with consent.
Section 11(5) disapplies the consent requirement where the processing is necessary to carry out the controller's obligations and specific rights in employment law, to protect vital interests where the data subject cannot consent, in the legitimate activities of a not-for-profit body confined to its members, to comply with national security laws, for legal claims with appropriate guarantees, where the data subject has made the data public, for scientific research on the Authority's conditions, or where a law authorises it for a substantial public interest.
Section 12 bars the processing of genetic data, biometric sensitive data and health data altogether unless the data subject has given written consent. The Act commenced on , so these provisions have bound since then.
Regulation 10(5)(a) bars a data controller from processing a child's personal information without the consent of the child's parent or legal guardian, and regulation 10(5)(b) requires reasonable efforts to verify that the consent was given or authorised by that parent or guardian, taking available technology into account.
Regulation 10(5)(d) requires regular data protection impact assessments to identify and mitigate privacy risks to children, regulation 10(5)(e) requires data protection by design and by default when processing children's data, and regulation 10(5)(f) bars subjecting children's data to automated decision making that has the effect of affecting the children's rights.
Regulation 10(3) separately bars subjecting any data subject to a decision based solely on automated processing which produces legal effects concerning them, without that data subject's consent or a provision established by law. Regulation 10(6) makes contravening the regulation an offence carrying a fine up to level 11 or up to seven years' imprisonment, or both.
The Regulations were made by the Minister of Information Communications Technology, Postal and Courier Services in consultation with the Authority under section 32 of the Cyber and Data Protection Act, and took effect on their publication on .
Zimbabwe has no scraping-specific statute, so general law governs each dimension separately.
The Cyber and Data Protection Act [Chapter 12:07] (No. 5 of 2021) repealed and substituted sections 163 to 166 of the Criminal Law (Codification and Reform) Act [Chapter 9:23], creating a hacking offence keyed to whether the accused knew or suspected they needed prior authority to access the data, programme or system (s. 163), and separate offences for unlawful acquisition of data by intercepting, overcoming a protective security measure, or acquiring data (s. 163A), unlawful interference with data (s. 163B), unlawful interference with a computer system (s. 163C), unlawful disclosure of a data code (s. 163D), and unlawful use of data or devices such as access codes or malicious software (s. 163E); no reported Zimbabwean case construes any of these sections' application to a web scraper reading a public, unauthenticated page.
No Zimbabwe court has ruled on the enforceability of a browsewrap or clickwrap terms of service against a scraper.
The Copyright and Neighbouring Rights Act [Chapter 26:05] (Act 11 of 2000, in force ) permits fair dealing for research or private study unless it results in copies of substantially the same material reaching more than one person at the same time (s. 24), but enacts no text-and-data-mining exception; its definition of "literary work" extends to "tables and compilations" alongside computer programs (s. 2), so a database is protected only as a compilation-type literary work rather than through a separate sui generis database right.
Personal-data reach over scraped public personal data is governed by the Cyber and Data Protection Act, researched in full under the privacy topic; its application provisions carry no publicly-available-data exemption, and processing genetic, biometric or health data is prohibited without written consent.
No Zimbabwe statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, and no provision assigns legal weight to a robots.txt directive or states an AI-training-specific rule.
Section 163 (Hacking) makes it an offence for a person who knows or suspects they must obtain prior authority to access data, a computer programme, a data storage medium, or a computer system, to intentionally and unlawfully secure access without that authority, liable to a fine not exceeding level 10 or imprisonment not exceeding five years, or both, rising to level 14 or ten years in aggravating circumstances.
Section 163A (Unlawful acquisition of data) penalises intercepting a private data transmission, overcoming or circumventing a protective security measure to prevent access, or acquiring data within or transmitted to or from a computer system, at a fine not exceeding level 14 or imprisonment not exceeding five years, or both (ten years aggravated); possessing data known to have been unlawfully acquired is a separate, identically punished offence.
Section 163B (Unlawful interference with data or a data storage medium) and section 163C (Unlawful interference with a computer system) penalise damaging, deleting, altering, blocking access to, or otherwise interfering with computer data or the functioning of a computer or information system, at up to level 10 or five years for data interference (level 14 or ten years aggravated) and up to level 14 or ten years for system interference (twenty years aggravated).
Section 163D (Unlawful disclosure of a data code) penalises communicating an access code or password to a person not authorised to use it, or creating, altering or destroying such a code, at a fine not exceeding level 12 or imprisonment not exceeding ten years, or both, unless the act is authorised by law.
Section 163E (Unlawful use of data or devices) penalises acquiring, possessing, or supplying an access code, password, or programme designed to commit an offence under the Act, at up to level 12 or ten years, and assembling or using malicious software to damage data or systems, at up to level 10 or five years (level 12 or ten years aggravated).
None of these sections defines "unlawfully" or "authority" by reference to a public, unauthenticated web page; each turns on whether the accused knew or suspected they lacked authority, or overcame a protective security measure, to access or acquire the data.
Zimbabwe's Censorship and Entertainments Control Act [Chapter 10:04] (in force ) establishes the Board of Censors, which may approve a film or public entertainment subject to a condition that it not be exhibited or given to persons of a Board-specified age or sex; no person of that specified age or sex may then be present, and the person in charge of the venue must display the restriction and must not advertise the film or entertainment without it.
The age threshold under this scheme is set case by case in the Board's approval condition rather than fixed by the Act at a single statutory number, and the Act's supply and possession restrictions on undesirable or prohibited publications, pictures, statues and records bind the public generally rather than gating access by age. No provision reaches an online or on-demand service, a social-media platform, or an app store.
The Broadcasting Services Act [Chapter 12:06] gives the Broadcasting Authority of Zimbabwe content-standard and licence-condition powers over broadcasting licensees but names no age threshold or minor-access duty in the provisions reviewed. No separate statute addressing social-media minor access, app-store age verification, or an age-appropriate design duty for a service likely to be accessed by children has been located.
Where the Board of Censors has approved a film, film advertisement, or public entertainment subject to a condition that it not be exhibited or given to persons of a specified age or sex, no person of that specified age or sex may be present at the place where it is being exhibited or given, subject to a defence for a person present in the course of employment or outside the admitted area (s. 27(1)).
A person who contravenes this is liable to a fine not exceeding level four or imprisonment not exceeding three months, or both (s. 27(2)). Separately, where the Board has imposed such a condition, the person in charge of the place or premises must cause the relevant restriction to be prominently displayed, and no person may publish or exhibit an advertisement of the film or entertainment unless the restriction is published or exhibited with it (s. 28(1)).
The age at which admission is restricted is set by the Board's approval condition for each film, advertisement or entertainment rather than fixed by the Act itself at a single statutory number.
Zimbabwe has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the Copyright and Neighbouring Rights Act [Chapter 26:05] (Act 11 of 2000, in force ) is the only enacted law reaching an aggregator's reproduction of news content.
Section 30(2) lets an article published in a newspaper or periodical, or in a broadcast, on a current economic, political, or religious topic be reproduced in the press or in a broadcast or cable programme without the author's authorisation, if the right of reproduction has not been expressly reserved and sufficient acknowledgement is given; this express-reservation proviso is the closest the Act comes to an author-side opt-out, though it predates the concept of a machine-readable reservation and is not framed as one.
Section 29 separately excuses fair dealing for the purposes of criticism, review, or reporting current events, subject to sufficient acknowledgement, except where the work is used to report current events by means of an audio-visual work, a sound recording, a broadcast, or a programme-carrying signal, and except that using a photograph to report current events is never fair dealing; section 31 excuses a quotation from a literary or musical work, including a quotation from an article in a journal that summarises the work, where the quotation is compatible with fair practice, does not exceed the extent justified by the purpose, and is sufficiently acknowledged.
The Act's neighbouring-rights provisions reach performers and broadcasting organisations, not print or online news publishers as such, so there is no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates.
No statute or reported case addresses whether a hyperlink is a communication to the public or whether framing or inline display changes the answer, and the Act predates the concept of a machine-readable text-and-data-mining opt-out; no reported Zimbabwe decision applies section 29 or 31 to a systematic news aggregator rather than a traditional newspaper or broadcaster.
Section 30(1) provides that the copyright in a lecture, address, speech or other similar work delivered in public is not infringed by its reproduction in the press or a broadcast for the purpose of information, and section 30(2) provides that the copyright in an article published in a newspaper or periodical, or a broadcast, on a current economic, political, or religious topic is not infringed by reproduction in the press or in a broadcast or cable programme, if the right of reproduction has not been expressly reserved and sufficient acknowledgement is given; neither exception applies where it conflicts with a normal exploitation of the work or unreasonably prejudices the copyright owner's legitimate interests (s. 30(3)).
Section 29 excuses fair dealing for the purposes of criticism or review of a work, or of reporting current events, subject to sufficient acknowledgement, except where the work is used to report current events by means of an audio-visual work, a sound recording, a broadcast, or a programme-carrying signal, and except that using a photograph to report current events is never fair dealing.
Section 31 excuses a quotation from a literary or musical work, including a quotation from an article in a journal that summarises the work, where the quotation is compatible with fair practice, does not exceed the extent justified by the purpose, and is sufficiently acknowledged.
The Act's neighbouring-rights provisions protect performers, producers of sound recordings, and broadcasting organisations rather than a print or online news publisher as such, so no publisher-side neighbouring right exists, and the Act contains no text-and-data-mining exception, no reference to hyperlinking or framing, and no compelled-bargaining mechanism.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Zimbabwe has no AI-transparency, AI-risk-obligations, AI-training-data, AI-prohibited-practices, AI-governance, or AI-sector-rules statute in force.
Cabinet approved a Zimbabwe National Artificial Intelligence Strategy 2026-2030 launched , a non-binding government policy document setting out pillars for talent development, infrastructure, sectoral adoption, governance and ethics, research, and international collaboration, and establishing an AI Strategy Implementation Office to coordinate execution; sources differ on whether the strategy points toward a National AI Council or a proposed Zimbabwe AI Regulatory Authority with an accompanying regulatory sandbox, and no enabling legislation establishing either has been enacted.
The Cyber and Data Protection Act [Chapter 12:07] (No. 5 of 2021), researched in full under the privacy topic, regulates automated decision-making only as an incident of personal-data processing (a data subject's rights against a decision based solely on automated processing) rather than through a duty attaching to an AI system as such.
No provision of the Cyber and Data Protection Act, the Criminal Law (Codification and Reform) Act [Chapter 9:23], or the Censorship and Entertainments Control Act [Chapter 10:04] names an AI-generated, computer-generated, or deepfake depiction as such; the Censorship Act's general obscenity and undesirability standards, and the Criminal Law Code's computer-misuse insertions, bind conduct without reference to whether AI produced the content.
As of .
Cybersecurity law
Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] (Act No. 5 of 2021) is enacted and in force, gazetted with its correct title and chapter number on by GN 492/2022, republishing the Act first gazetted on as explained in GN 491/2022.
Read in full, it is a comprehensive data-protection statute (Parts I to X, sections 1 to 34) with a block of consequential criminal-law and evidence-law amendments attached (Part XI, sections 35 to 37), and none of its provisions impose a standalone, operator-facing security-posture duty distinct from the data-protection regime's own security clause or from its offence chapters.
Section 5 designates the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the Data Protection Authority, and Section 6 confines the Authority's functions to regulating and enforcing fair processing of personal data, investigating complaints, and advising the responsible Minister; POTRAZ carries no separate network-security or cyber-resilience mandate under this Act.
Part V, 'Duties of Data Controller and Data Processor', is where the Act's only security-shaped provisions sit: Section 18 requires a data controller or processor to take appropriate technical and organisational measures to protect data from negligent or unauthorised destruction, loss, alteration or access and any other unauthorised processing, weighed against the state of technological development, implementation cost, the nature of the data and the risk to the data subject, and lets the Authority issue information-security standards for categories of processing; Section 19 requires the data controller to notify the Authority within twenty-four hours of any security breach affecting data it processes.
Because both provisions live inside this Act's own comprehensive personal-data-protection regime, the same shape as General Data Protection Regulation (GDPR) Article 32 and its Article 33/34 breach-notice pair, they are this jurisdiction's privacy-topic security-of-processing and breach-notification findings under Test 2 and are not restated here.
The Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (SI 2024-155, made under Section 32 of the Act, gazetted ) confirm the same seam: Section 16 elaborates the Act's Section 18 security-of-processing duty (risk assessment, technical and organisational measures, restoring availability after an incident, testing the effectiveness of measures) and Section 17 restates the Act's twenty-four-hour breach-notification clock to the Authority with an added seventy-two-hour duty to inform affected data subjects where the risk is high, with contravention of either section an offence carrying a fine up to level 11 or up to seven years' imprisonment; the Regulations' own licensing scheme (Sections 3 to 9) gates on processing personal information for commercial gain or on deciding the means and purpose of processing, never on a security-standard licensing criterion, so it does not reach Test 1 either.
Section 16(6) of the Regulations names, without placing a duty on either body, the Cyber Security and Monitoring of Interception of Communications Centre and 'the Cyber Incident Response Team (zw-CIRT)' as bodies that 'may give technical advice' to a data controller or processor; that is the only appearance of a national CERT in either instrument, and it is advisory rather than a duty running from a controller to the CERT.
Part XI's three consequential amendments are the Act's whole 'cyber' half, and none of them reaches an operator's own security posture.
Section 35 repeals and replaces sections 162 to 166 of the Criminal Law (Codification and Reform) Act [Chapter 9:23] with a new Chapter VIII carrying two parts of intruder offences: hacking (163), unlawful acquisition of data (163A), unlawful interference with data or a data storage medium (163B), unlawful interference with a computer system (163C), unlawful disclosure of a data code (163D), unlawful use of data or devices (163E), and a further set of electronic-communications offences (164 to 164F, covering incitement to violence, sending a threatening data message, cyber-bullying, transmitting a false data message intending harm, spam, transmitting an intimate image without consent, and producing or disseminating racist or xenophobic material); every one of these binds the person attacking or misusing a system, not the system's operator, so this is the jurisdiction's scraping-topic finding, and it is not restated here.
Section 36 inserts a new Part XXA (sections 379A to 379F) into the Criminal Procedure and Evidence Act [Chapter 9:07], giving a magistrate power to order search, seizure and expedited preservation of computer data for a criminal investigation, setting the conditions under which an access, hosting, caching or internet service provider is immune from criminal liability for third-party content it did not initiate (conditioned on prompt removal after a court or authority order, section 379C), fixing jurisdiction and the admissibility of electronic evidence, and providing for forfeiture; these are investigative and evidentiary powers running to law enforcement, plus a conditional notice-and-takedown immunity, and none of them is a security-posture duty.
Section 37 amends the Interception of Communications Act [Chapter 11:20] to rename its monitoring centre the Cyber Security and Monitoring of Interception of Communications Centre, established as a unit in the Office of the President, and gives it functions that are advisory and coordinating rather than binding on any operator: it is the sole facility for authorised interceptions, advises Government on cybercrime and cyber-security policy, coordinates a national contact point, operates a whistle-blower system, and 'may give technical advice' and provide guidelines to public and private-sector parties, with a separate ad hoc Cyber Security Committee advising the Minister on interception warrants; no provision in Section 37 requires an electronic communications service provider, or any other private party, to meet a security standard, register a system, or report an incident to the Centre.
No instrument creates a critical-infrastructure-operator duty either: 'critical database' and 'critical information infrastructure' are terms defined in the amended section 162 and used only to raise the penalty tier for an intruder offence under sections 163 and 163A to 163E when the target is a critical system, never to impose a duty on the entity that operates one.
Zimbabwe has no general reasonable-security or information-security-programme statute with no sector gate; the Act's Section 18 is the nearest analogue and, as explained above, is this jurisdiction's privacy-topic finding. The Reserve Bank of Zimbabwe's Cybersecurity and Resilience Guideline of August 2025 states that it is issued pursuant to the Banking Act (Chapter 24:20), the Microfinance Act (Chapter 24:30) and the National Payment Systems Act (Chapter 24:23).
Paragraph 8.11 of the Reserve Bank of Zimbabwe's Cybersecurity and Resilience Guideline says that institutions should report all confirmed cybersecurity incidents to the Reserve Bank within three hours of detection, or as soon as the institution becomes aware of the incident.
As of .
Case law
No current case law for Zimbabwe AI law
No current case law for Zimbabwe privacy law
No current case law for Zimbabwe scraping law
No current case law for Zimbabwe cybersecurity law
No current case law for Zimbabwe communications law
No current case law for Zimbabwe content moderation law
No current case law for Zimbabwe product and AI liability law
No current case law for Zimbabwe digital accessibility law
No current case law for Zimbabwe age gating law
No current case law for Zimbabwe reuse law
Reporting clocks that run here2 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Zimbabwe comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Report a personal data breach to the Authority within 24 hours of becoming aware of it, on Form DP3 in the Fourth Schedule.
Inform the affected data subjects within 72 hours where the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms.
Finish the data breach investigation and submit your report within 21 days from the date of notification.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
