Loi 5/2021 · Data Protection Act [Chapter 11:12]

This text establishes the terms and conditions of office for members of a Cybersecurity Committee. It defines the appointment period (up to five years), conditions for disqualification (conflicts of interest, insolvency, criminal convictions, holding other public offices), and procedures for vacation of office (resignation, imprisonment, dismissal). It also outlines the Committee's meeting procedures, quorum requirements, voting rules, and the validity of its decisions.

ARRANGEMENT OF SECTIONS

PART I

PRELIMINARY

Section

Short title.
Object.
Interpretation.
Application.

PART II

Data Protection Authority

Designation of Postal and Telecommunications Regulatory Authority as Data Protection Authority.

Functions of Data Protection Authority.

PART III

Quality of Data

7.Quality of data.

PART IV

General Rules on the Processing of Data

Generality.
Purpose.
Non-sensitive data.

11.Sensitive information. 12.Genetic data, biometric sensitive data and health data.

PART V

Duties of Data Controller and Data Processor

15.Disclosures when collecting data directly from data subject.

16.Disclosures when not collecting data directly from data subject.

13.Duties of Data Controller. 14.Rights of Data Subject. 17.Authority to process. 18. Security. 19. Security breach notification. 2Obligation of notification to Authority. 21. Content of notification. 22. Authorisation. 2Openness of processing. 24. Accountability.

PART VI

Data Suject

Section

Decision taken on basis of Automatic Data Processing. 26. Representation of data subjection who is a child. 7Representation of physically, mentally or legally incapacitated data subjects.

PART VII

TraNsBorDer FLow

Transfer of personal information outside Zimbabwe.
Transfer to country outside the Republic of Zimbabwe which does not assure adequate level of protection.

PART VIII

Code of Conduct

Code of conduct.

PART IX

WhisTLEBLoWIng

Whistleblower.

PART X

GEnERaL PROVIsioNs

Regulations.

33.Offences and penalties. 34. Appeals.

PART XI

COnsEQuENTIaL AmENDMENts

Amendment of Chapter VIII of Cap. 9:23.
Amendment of Cap. 9:07.
Amendment of Cap. 11:20.

ZIMBABWE

ACT

An Act to provide for data protection with due regard to the Declaration of Rights under the Constitution and the public and national interest; to establish a Data Protection Authority and to provide for their functions; to create a technology driven business environment and encourage technological development and the lawful use of technology; to amend sections 162 to 166 of the Criminal Code (Codification and Reform) Act [Chapter 9:23] to provide for investigation and collection of evidence of cyber crime and unauthorised data collection and breaches, and to provide for admissibility of electronic evidence for such offences; to amend the Interception of Communications Act [Chapter 11:20] to establish a Cyber Security Centre and to provide for matters connected with or incidental to the foregoing.

ENACTED by the Parliament and the President of Zimbabwe.

PART I

PRELIMINARY

1 Short title

This Act may be cited as the Data Protection Act [Chapter 11:22].

2 Object

The object of this Act is to increase data protection in order to build confidence and trust in the secure use of information and communication technologies by data controllers, their representatives and data subjects.

3 Interpretation

In this Act—

child” means any person under the age of eighteen years;