Securiti Named a 2022 Cool Vendor in Data Security by GartnerDownload Now
Zimbabwe has officially been in the process of legislating a concrete data protection bill since 2020. In May 2020, the Bill was formally gazetted with public hearings starting in July 2020. At this point, the Bill was still called the Cybersecurity and Data Protection Bill.
After almost 18 months of deliberations, debates, and modifications to the original Bill, Zimbabwe formally enacted the Data Protection Act (DPA) on December 3, 2021. While the new law deals with aspects of cybersecurity and cybercrime, the Act's primary focus is on data privacy and ensuring data protection for all data collected by data handlers within the country as well as outside the country if the means used for processing is located in Zimbabwe.
The DPA also brought amendments to the following existing laws within the Zimbabwean constitution:
As per the DPA, data controllers must process data fairly and lawfully. They must ensure that data is collected only for specified, explicit and legitimate purposes taking into account all relevant factors and ensure compliance with the provisions of the DPA.
The DPA will apply to any organisation established within or even outside Zimbabwe if the means used to process data were located in Zimbabwe and the processing of data was not done for transit of data purposes. However, if the data being collected is merely for the purpose of transiting the data from Zimbabwe, such data is exempt from this law.
Furthermore, all data handlers collecting data in Zimbabwe must hire a representative within Zimbabwe if they are not formally established or registered within Zimbabwe.
As per Zimbabwe's DPA, organisations have certain obligations towards their customers and users. Some of the most crucial responsibilities include:
As per the DPA, the data handler must seek consent in writing from the data subject to collect any sensitive personal data. Such consent may be withdrawn by the data subject at any time and free of charge. The processing of sensitive personal data can take place without the data subject’s consent only under certain limited grounds.
The processing of non-sensitive personal data is allowed without the consent of the data subject only on any of the following grounds:
Furthermore, the regulatory authority has the power to ask the data handler to cease the processing of any sensitive personal data even with the data subject’s consent under certain circumstances.
The DPA requires all data controllers to take appropriate technical and organisational measures that are necessary to protect data from unauthorised destruction, negligent loss, unauthorised alteration or access and any other unauthorised processing of the data.
Furthermore, it requires all data controllers to enter into a written contract with the data processor to protect the data they collect on users with the securest measures available to them.
All data controllers are required to report a breach within 24 hours to the regulatory authority.
The DPA does not explicitly require companies to appoint a data protection officer (DPO).
However, if an organisation does hire a DPO, it must duly inform the regulatory authority of the appointment. The DPO's role within the organization will be to ensure complete compliance with the law's provisions in an independent manner.
There are no requirements for the data handlers to conduct regular data protection impact assessments. However, since the DPA does allow the regulatory authority to carry out further inspection and assessment of the security and organisational measures employed by a data controller. Therefore, it is highly recommended that all data handlers conduct their own impact assessments especially for high-risk data processing activities to ensure their practices are in line with the DPA’s requirements.
The DPA does not provide any explicit record-keeping obligation as far as data processing activities are concerned. However, as per section 8 of the Schedule (section 4B(5) of the Act), the Cybersecurity Committee requires minutes of all proceedings of any decisions taken at every meeting of the committee to be entered in books kept in a confidential manner.
Personal data cannot be transferred outside Zimbabwe unless an adequate level of protection is ensured in the destination country. This will be determined by the regulatory authority keeping in mind what data is being transferred, the duration for which the data will need to be in the other country, whether the other country has data protection laws, and what steps can be taken in the country to ensure the data is not compromised in any way.
Once the regulatory authority has determined the other country is adequate or safe for the data to be transferred, the data handler can transfer the data there. Data transfers to countries that do not ensure an adequate level of protection can take place on any of the following grounds:
Here are the rights afforded to data subjects under the DPA:
All data subjects have the right to be informed of the use of their personal data;
All data subjects have the right to object to the processing of their personal information;
All data subjects have the right to request correction of false or misleading personal information;
All data subjects have the right to request that a data handler delete any data they may collect on them that the data subject considered false or incorrect.
Perhaps one of the most important differences between the version of the Bill that was gazetted and recently passed was the decision to set up an independent body, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as a data protection authority for the purposes of the law. POTRAZ is established in terms of the Postal and Telecommunications Act and has all the necessary legal enforcement powers to ensure the DPA is being enforced properly.
Zimbabwe's new data protection law sets forth some of the strictest penalties for non-compliance and breaches for data handlers. A data controller can be guilty of an offence and liable to a fine not exceeding level 11 or imprisonment for a period not exceeding seven years or both such fine and such imprisonment for violations of certain provisions.
Moreover, if the data handler is found guilty of non-compliance, the Courts have the power to direct law enforcement agencies to seize any media or storage devices that might contain compromised data on data subjects. Any data found in these media or devices will then be destroyed.
Any organisation aiming to achieve compliance with Zimbabwe’s new data protection act can do so by ensuring it follows the following necessities in its data collection practices:
Zimbabwe is just of the several nations that have or are in the process of enacting their own versions of a data protection law. The volatile nature of data privacy globally has meant that companies and websites now find themselves with the heightened responsibility to ensure all data collected by them is adequately protected, stored, and utilized.
Therein lies the problem for most organisations owing to the sheer volume of data they process. Ensuring compliance with these new data protection laws is only possible if organisations accept robotic automation as the ideal solution. Securiti has made a name for itself in the global data governance and privacy compliance sector owing to its Privacy Ops framework that automates data compliance for organisations using machine learning and artificial intelligence-backed tools.
Request a demo today to learn more about how these tools can help your organisation.
Get all the latest information, law updates and more delivered to your inbox
See how easy it is to manage privacy compliance with robotic automation.
PO Box 13039,
Coyote CA 95013