If your organisation collects or uses personal information — staff records, customer details, patient files, mobile‑money numbers — Zimbabwean law now places clear obligations on you. Here is a practical summary.
The law in brief
The Cyber and Data Protection Act [Chapter 12:07] sets out how personal data must be handled, and appoints the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the Data Protection Authority. In September 2024 the government introduced Statutory Instrument 155 of 2024 — the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations — which put the licensing and DPO requirements into practice.
Key obligations
- Licensing: organisations that decide how and why personal data is processed (data controllers) must hold a licence from POTRAZ. Licences are tiered by the number of data subjects, are valid for 12 months and must be renewed before they expire.
- Data Protection Officer: controllers must appoint a suitably qualified DPO to monitor compliance and protect data subjects’ rights.
- Breach notification: a personal‑data breach must be reported to POTRAZ within 24 hours of becoming aware of it, and affected individuals informed within 72 hours where the breach poses a high risk to them.
- Security of processing: you must protect personal data with appropriate technical and organisational measures.
Where IT and security come in
A 24‑hour breach deadline is only achievable if you can detect a breach quickly and understand what was affected. That means:
- An inventory of where personal data lives — servers, cloud apps, laptops, email.
- Access controls and multi‑factor authentication on systems holding personal data.
- Encryption of laptops, databases and backups.
- Central logging and monitoring, so suspicious activity is spotted and investigated.
- A written incident‑response plan that names who notifies POTRAZ and how.
How NetCore helps
We map your personal data, close technical gaps, set up monitoring and prepare the evidence your DPO needs — so compliance is something you can demonstrate, not just claim.
This article is general guidance, not legal advice. Confirm your specific obligations with POTRAZ or a legal practitioner.
Sources: Afriwise — Quick‑start guide to Zimbabwe’s data protection regulations; DLA Piper Africa; MISA Zimbabwe.