Overview of Zimbabwe New Data Protection Act

Zimbabwe has officially been in the process of legislating a concrete data protection bill since 2020. In May 2020, the Bill was formally gazetted with public hearings starting in July 2020. At this point, the Bill was still called the Cybersecurity and Data Protection Bill.

After almost 18 months of deliberations, debates, and modifications to the original Bill, Zimbabwe formally enacted the Data Protection Act (DPA) on December 3, 2021. While the new law deals with aspects of cybersecurity and cybercrime, the Act's primary focus is on data privacy and ensuring data protection for all data collected by data handlers within the country as well as outside the country if the means used for processing is located in Zimbabwe.

The DPA also brought amendments to the following existing laws within the Zimbabwean constitution:

• Criminal Law (Codification and Reform Act).
• The Criminal Procedure and Evidence Act.
• The Interception of Communications Act.

As per the DPA, data controllers must process data fairly and lawfully. They must ensure that data is collected only for specified, explicit and legitimate purposes taking into account all relevant factors and ensure compliance with the provisions of the DPA.

Who Needs to Comply with the DPA

The DPA will apply to any organisation established within or even outside Zimbabwe if the means used to process data were located in Zimbabwe and the processing of data was not done for transit of data purposes. However, if the data being collected is merely for the purpose of transiting the data from Zimbabwe, such data is exempt from this law.

Furthermore, all data handlers collecting data in Zimbabwe must hire a representative within Zimbabwe if they are not formally established or registered within Zimbabwe.

Obligations for Organizations Under that Specific Law

As per Zimbabwe's DPA, organisations have certain obligations towards their customers and users. Some of the most crucial responsibilities include:

Consent Requirements

As per the DPA, the data handler must seek consent in writing from the data subject to collect any sensitive personal data. Such consent may be withdrawn by the data subject at any time and free of charge. The processing of sensitive personal data can take place without the data subject’s consent only under certain limited grounds.

The processing of non-sensitive personal data is allowed without the consent of the data subject only on any of the following grounds:

• Where the processing is necessary for the purposes of being material as evidence in proving an offense;
• Where the processing is necessary to comply with a legal obligation;
• Where the processing is necessary to protect the vital interests of the data subject;
• Where the processing is carried out in the public interest or in the exercise of official authority;
• Where the processing is to promote the legitimate interests of the data controller.

Furthermore, the regulatory authority has the power to ask the data handler to cease the processing of any sensitive personal data even with the data subject’s consent under certain circumstances.

Security Requirements

The DPA requires all data controllers to take appropriate technical and organisational measures that are necessary to protect data from unauthorised destruction, negligent loss, unauthorised alteration or access and any other unauthorised processing of the data.

Furthermore, it requires all data controllers to enter into a written contract with the data processor to protect the data they collect on users with the securest measures available to them.

Data Breach Notification Requirement

All data controllers are required to report a breach within 24 hours to the regulatory authority.

Data Protection Officer Requirement

The DPA does not explicitly require companies to appoint a data protection officer (DPO).
However, if an organisation does hire a DPO, it must duly inform the regulatory authority of the appointment. The DPO's role within the organization will be to ensure complete compliance with the law's provisions in an independent manner.

Data Protection Impact Assessment

There are no requirements for the data handlers to conduct regular data protection impact assessments. However, since the DPA does allow the regulatory authority to carry out further inspection and assessment of the security and organisational measures employed by a data controller. Therefore, it is highly recommended that all data handlers conduct their own impact assessments especially for high-risk data processing activities to ensure their practices are in line with the DPA’s requirements.

Record of Processing Activities

The DPA does not provide any explicit record-keeping obligation as far as data processing activities are concerned. However, as per section 8 of the Schedule (section 4B(5) of the Act), the Cybersecurity Committee requires minutes of all proceedings of any decisions taken at every meeting of the committee to be entered in books kept in a confidential manner.

Cross border data transfer Requirements

Personal data cannot be transferred outside Zimbabwe unless an adequate level of protection is ensured in the destination country. This will be determined by the regulatory authority keeping in mind what data is being transferred, the duration for which the data will need to be in the other country, whether the other country has data protection laws, and what steps can be taken in the country to ensure the data is not compromised in any way.

Once the regulatory authority has determined the other country is adequate or safe for the data to be transferred, the data handler can transfer the data there. Data transfers to countries that do not ensure an adequate level of protection can take place on any of the following grounds:

• Where the data subject has unambiguously given his or her consent;
• Where the transfer is necessary for the performance of the contract;
• Where the transfer is necessary on public interest grounds;
• Where the transfer is necessary to protect vital interests of the data subject;
• Where the transfer is made from a register which is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest.