Overview of Zimbabwe New Data Protection Act

Zimbabwe has officially been in the process of legislating a concrete data protection bill since 2020. In May 2020, the Bill was formally gazetted with public hearings starting in July 2020. At this point, the Bill was still called the Cybersecurity and Data Protection Bill.

After almost 18 months of deliberations, debates, and modifications to the original Bill, Zimbabwe formally enacted the Data Protection Act (DPA) on December 3, 2021. While the new law deals with aspects of cybersecurity and cybercrime, the Act's primary focus is on data privacy and ensuring data protection for all data collected by data handlers within the country as well as outside the country if the means used for processing is located in Zimbabwe.

The DPA also brought amendments to the following existing laws within the Zimbabwean constitution:

• Criminal Law (Codification and Reform Act).
• The Criminal Procedure and Evidence Act.
• The Interception of Communications Act.

As per the DPA, data controllers must process data fairly and lawfully. They must ensure that data is collected only for specified, explicit and legitimate purposes taking into account all relevant factors and ensure compliance with the provisions of the DPA.

Who Needs to Comply with the DPA

The DPA will apply to any organisation established within or even outside Zimbabwe if the means used to process data were located in Zimbabwe and the processing of data was not done for transit of data purposes. However, if the data being collected is merely for the purpose of transiting the data from Zimbabwe, such data is exempt from this law.

Furthermore, all data handlers collecting data in Zimbabwe must hire a representative within Zimbabwe if they are not formally established or registered within Zimbabwe.

Obligations for Organizations Under that Specific Law

As per Zimbabwe's DPA, organisations have certain obligations towards their customers and users. Some of the most crucial responsibilities include:

1. Consent Requirements

As per the DPA, the data handler must seek consent in writing from the data subject to collect any sensitive personal data. Such consent may be withdrawn by the data subject at any time and free of charge. The processing of sensitive personal data can take place without the data subject’s consent only under certain limited grounds.

The processing of non-sensitive personal data is allowed without the consent of the data subject only on any of the following grounds:

• Where the processing is necessary for the purposes of being material as evidence in proving an offense;
• Where the processing is necessary to comply with a legal obligation;
• Where the processing is necessary to protect the vital interests of the data subject;
• Where the processing is carried out in the public interest or in the exercise of official authority;
• Where the processing is to promote the legitimate interests of the data controller.

Furthermore, the regulatory authority has the power to ask the data handler to cease the processing of any sensitive personal data even with the data subject’s consent under certain circumstances.

2. Security Requirements

The DPA requires all data controllers to take appropriate technical and organisational measures that are necessary to protect data from unauthorised destruction, negligent loss, unauthorised alteration or access and any other unauthorised processing of the data.

Furthermore, it requires all data controllers to enter into a written contract with the data processor to protect the data they collect on users with the securest measures available to them.

3. Data Breach Notification Requirement

All data controllers are required to report a breach within 24 hours to the regulatory authority.

4. Data Protection Officer Requirement

The DPA does not explicitly require companies to appoint a data protection officer (DPO).
However, if an organisation does hire a DPO, it must duly inform the regulatory authority of the appointment. The DPO's role within the organization will be to ensure complete compliance with the law's provisions in an independent manner.

5. Data Protection Impact Assessment

There are no requirements for the data handlers to conduct regular data protection impact assessments. However, since the DPA does allow the regulatory authority to carry out further inspection and assessment of the security and organisational measures employed by a data controller. Therefore, it is highly recommended that all data handlers conduct their own impact assessments especially for high-risk data processing activities to ensure their practices are in line with the DPA’s requirements.

6. Record of Processing Activities

The DPA does not provide any explicit record-keeping obligation as far as data processing activities are concerned. However, as per section 8 of the Schedule (section 4B(5) of the Act), the Cybersecurity Committee requires minutes of all proceedings of any decisions taken at every meeting of the committee to be entered in books kept in a confidential manner.

7. Cross border data transfer Requirements

Personal data cannot be transferred outside Zimbabwe unless an adequate level of protection is ensured in the destination country. This will be determined by the regulatory authority keeping in mind what data is being transferred, the duration for which the data will need to be in the other country, whether the other country has data protection laws, and what steps can be taken in the country to ensure the data is not compromised in any way.

Once the regulatory authority has determined the other country is adequate or safe for the data to be transferred, the data handler can transfer the data there. Data transfers to countries that do not ensure an adequate level of protection can take place on any of the following grounds:

• Where the data subject has unambiguously given his or her consent;
• Where the transfer is necessary for the performance of the contract;
• Where the transfer is necessary on public interest grounds;
• Where the transfer is necessary to protect vital interests of the data subject;
• Where the transfer is made from a register which is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest.

Data Subject Rights

Here are the rights afforded to data subjects under the DPA:

Regulatory Authority

Perhaps one of the most important differences between the version of the Bill that was gazetted and recently passed was the decision to set up an independent body, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), as a data protection authority for the purposes of the law. POTRAZ is established in terms of the Postal and Telecommunications Act and has all the necessary legal enforcement powers to ensure the DPA is being enforced properly.

Penalties for Non-compliance

Zimbabwe's new data protection law sets forth some of the strictest penalties for non-compliance and breaches for data handlers. A data controller can be guilty of an offense and liable to a fine not exceeding level 11 or imprisonment for a period not exceeding seven years or both such fine and such imprisonment for violations of certain provisions.

Moreover, if the data handler is found guilty of non-compliance, the Courts have the power to direct law enforcement agencies to seize any media or storage devices that might contain compromised data on data subjects. Any data found in these media or devices will then be destroyed.

How an Organisation Can Operationalize the DPA

Any organisation aiming to achieve compliance with Zimbabwe’s new data protection act can do so by ensuring it follows the following necessities in its data collection practices:

• Hire a competent representative within Zimbabwe if the data handler is not formally registered in Zimbabwe;
• Disclose how and why the data handler is collecting data via a transparent privacy policy;
• Have a robust consent management system in place to ensure consent is gained as per the law;
• Carry out routine data mapping exercises to have a detailed structure of all data being collected, stored, and transferred to ensure compliance;
• Conduct regular data protection impact and risk assessments to ensure you remain compliant with the new regulations.

How can Securiti Help

Zimbabwe is just of the several nations that have or are in the process of enacting their own versions of a data protection law. The volatile nature of data privacy globally has meant that companies and websites now find themselves with the heightened responsibility to ensure all data collected by them is adequately protected, stored, and utilized.

Therein lies the problem for most organizations owing to the sheer volume of data they process. Ensuring compliance with these new data protection laws is only possible if organizations accept robotic automation as the ideal solution. Securiti has made a name for itself in the global data governance and privacy compliance sector owing to its Privacy Ops framework that automates data compliance for organizations using machine learning and artificial intelligence-backed tools.

Request a demo today to learn more about how these tools can help your organization.