Regulations › Rest of world › Zimbabwe
CDPA (Zimbabwe)
Cyber and Data Protection Act, 2021 (Zimbabwe)
WhenGazetted in December 2021; licensing regulations (SI 155 of 2024) followed
Who enforces itPOTRAZ, as Data Protection Authority
Who it applies toData controllers processing personal data in Zimbabwe.
Tell the regulatorNotify POTRAZ within 24 hours of becoming aware, on Form DP3
DPO requiredEvery data controller must appoint a DPO and notify POTRAZ on Form DP2
RegistrationControllers processing data of 50 or more people need a POTRAZ licence, tiered USD 50-2,500, r…
Transfers abroadTransfers abroad need adequate protection in the recipient country or a listed derogation such…
Request deadlineNo fixed response deadline in the Act or SI 155
Maximum fineFines up to level 11 (reported at about USD 1,000) and/or up to 7 years' imprisonment
62%
of Zimbabwe's 21 requirements are already met by European Union (GDPR). Here is what CDPA (Zimbabwe) adds, biggest gaps first.
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
CDPA (Zimbabwe) adds3 Controllers processing data of 50 or more people need a POTRAZ licence, tiered USD 50-2,500, renewed every 12 months.
Regs 3-9, SI 155/2024 · source ↗
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
CDPA (Zimbabwe) adds3 Every data controller must appoint a DPO and notify POTRAZ on Form DP2.
s.20(5); Reg. 12(1), SI 155/2024 · source ↗
DPO qualificationsGovernanceBig gap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
CDPA (Zimbabwe) adds3 DPOs must complete a POTRAZ-approved certification course from an accredited provider and keep certification through CPD.
Regs 10(1), 13(1)-(3), SI 155/2024 · source ↗
Criminal liabilityEnforcementBig gap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
CDPA (Zimbabwe) adds3 Most breaches of the Act and SI 155 are offenses, carrying up to 7 years' imprisonment; failing to appoint a DPO up to 2 years.
s.33; Regs 3(3), 5(3), 10(6), 12(6), 16(7), 17(6), SI 155/2024 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
CDPA (Zimbabwe) adds3 Age 18. Parents or guardians consent and exercise rights; controllers must verify consent and run regular DPIAs for children's data.
s.3; s.26; Reg. 10(5), SI 155/2024 · source ↗
RecordsGovernanceGap
GDPR2 Controllers and processors keep records of processing; limited exemption for organizations under 250 employees doing occasional, low-risk processing.
CDPA (Zimbabwe) adds3 Controllers must notify the Authority of all processing activities, including purposes and retention, and keep a breach register.
s.21(1); Regs 10(2)(a), 17(4)(b), SI 155/2024 · source ↗
Tell the regulatorBreachesGap
GDPR2 Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
CDPA (Zimbabwe) adds3 Notify POTRAZ within 24 hours of becoming aware, on Form DP3; investigation report within 21 days.
s.19; Reg. 17(1)-(2), (5), SI 155/2024 · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
CDPA (Zimbabwe) adds3 Inform data subjects within 72 hours where the breach is likely to result in high risk.
Reg. 17(3), SI 155/2024 · source ↗
Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Rights, Request deadline, Marketing, DPIA, Retention, Transfers abroad, Localization, Maximum fine, Private action.
A gap means CDPA (Zimbabwe) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws