Data Protection Act [Chapter 11:12]

# DATA PROTECTION ACT [CHAPTER 11:12]

# ARRANGEMENT OF SECTIONS

# PART I

# PRELIMINARY

# Section

1. Short title.
2. Object.
3. Interpretation.
4. Application.

# PART II

# Data Protection Authority

1. Designation of Postal and Telecommunications Regulatory Authority as Data Protection Authority.

Functions of Data Protection Authority.

# PART III

# Quality of Data

7.Quality of data.

# PART IV

# General Rules on the Processing of Data

1. Generality.
2. Purpose.
3. Non-sensitive data.

11.Sensitive information. 12.Genetic data, biometric sensitive data and health data.

# PART V

# Duties of Data Controller and Data Processor

15.Disclosures when collecting data directly from data subject.

16.Disclosures when not collecting data directly from data subject.

13.Duties of Data Controller. 14.Rights of Data Subject. 17.Authority to process. 18. Security. 19. Security breach notification. 2Obligation of notification to Authority. 21. Content of notification. 22. Authorisation. 2Openness of processing. 24. Accountability.

# PART VI

# Data Suject

# Section

Decision taken on basis of Automatic Data Processing. 26. Representation of data subjection who is a child. 7Representation of physically, mentally or legally incapacitated data subjects.

# PART VII

# TraNsBorDer FLow

1. Transfer of personal information outside Zimbabwe.
2. Transfer to country outside the Republic of Zimbabwe which does not assure adequate level of protection.

# PART VIII

# Code of Conduct

1. Code of conduct.

# PART IX

# WhisTLEBLoWIng

1. Whistleblower.

# PART X

# GEnERaL PROVIsioNs

1. Regulations.

33.Offences and penalties. 34. Appeals.

# PART XI

# COnsEQuENTIaL AmENDMENts

1. Amendment of Chapter VIII of Cap. 9:23.
2. Amendment of Cap. 9:07.
3. Amendment of Cap. 11:20.


# ZIMBABWE

# ACT

An Act to provide for data protection with due regard to the Declaration of Rights under the Constitution and the public and national interest; to establish a Data Protection Authority and to provide for their functions; to create a technology driven business environment and encourage technological development and the lawful use of technology; to amend sections 162 to 166 of the Criminal Code (Codification and Reform) Act [Chapter 9:23] to provide for investigation and collection of evidence of cyber crime and unauthorised data collection and breaches, and to provide for admissibility of electronic evidence for such offences; to amend the Interception of Communications Act [Chapter 11:20] to establish a Cyber Security Centre and to provide for matters connected with or incidental to the foregoing.

ENACTED by the Parliament and the President of Zimbabwe.

PART I

PRELIMINARY

# 1 Short title

This Act may be cited as the Data Protection Act [Chapter 11:22].

# 2 Object

The object of this Act is to increase data protection in order to build confidence and trust in the secure use of information and communication technologies by data controllers, their representatives and data subjects.

# 3 Interpretation

In this Act—

child” means any person under the age of eighteen years;