Law: Data Protection Act (the Act)

Regulator: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ)

Summary: The Cyber and Data Protection Act (the Act) was enacted on December 3, 2021, although an official transition period or date for entry into force has not been announced. Initially established under the Postal and Telecommunications Act, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) has now been designated as the data protection authority responsible for enforcing the processing of personal data in accordance with the Act. In general terms, the Act focuses on breach and data processing notifications to POTRAZ, data security, online conduct, whistleblowers, data transfers, and limited data subject rights.

POTRAZ published a draft for the Cyber and Data Protection Regulations, 2022 (the Draft Regulations) pursuant to Section 32 of the Act in November 2022. The Draft Regulations clarify obligations under the Act including the registration of data controllers and processors, conducting a legitimate interest assessment, and data breach notification procedures. Further, the Draft Regulations outline obligations specific to organizations in healthcare, insurance, and banking.