Regulations › Rest of world › Zimbabwe
CDPA (Zimbabwe)
Cyber and Data Protection Act, 2021 (Zimbabwe)
WhenGazetted in December 2021; licensing regulations (SI 155 of 2024) followed
Who enforces itPOTRAZ, as Data Protection Authority
Who it applies toData controllers processing personal data in Zimbabwe.
Tell the regulatorNotify POTRAZ within 24 hours of becoming aware, on Form DP3
DPO requiredEvery data controller must appoint a DPO and notify POTRAZ on Form DP2
RegistrationControllers processing data of 50 or more people need a POTRAZ licence, tiered USD 50-2,500, r…
Transfers abroadTransfers abroad need adequate protection in the recipient country or a listed derogation such…
Request deadlineNo fixed response deadline in the Act or SI 155
Maximum fineFines up to level 11 (reported at about USD 1,000) and/or up to 7 years' imprisonment
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
1
Applies to controllers active in Zimbabwe and to controllers not established there that use means located in Zimbabwe.s.4(2)(a)-(b) · source ↗
Lawful basis
1
Consent or listed grounds including legal obligation, vital interests, public interest and legitimate interests of the controller or third party.s.10(1), (3) · source ↗
Consent
1
Consent must be specific, unequivocal, freely given and informed but may be implied for adults; sensitive data needs written consent.s.3 (definition); s.10(2); s.11(1) · source ↗
Sensitive data
2
Sensitive, genetic, biometric and health data require written consent or listed exceptions; some uses need Authority authorization.ss.11-12; s.12(9); s.22 · source ↗
Children
3
Age 18. Parents or guardians consent and exercise rights; controllers must verify consent and run regular DPIAs for children's data.s.3; s.26; Reg. 10(5), SI 155/2024 · source ↗
People's rights
Rights
2
Information, access, objection, correction and deletion of false data, and protection from solely automated decisions.ss.14, 25 · source ↗
No portability or restriction right.
Request deadline
0
No fixed response deadline in the Act or SI 155.s.13(f) ('without delay' for erasure/rectification) · source ↗
Marketing
1
Data subjects may object free of charge to processing for direct marketing; no opt-in rule.s.15(1)(c); s.16(1)(d) · source ↗
Section numbers from ZimLII summary; DLA Piper says electronic marketing is not addressed.
Governance
DPO required
3
Every data controller must appoint a DPO and notify POTRAZ on Form DP2.s.20(5); Reg. 12(1), SI 155/2024 · source ↗
DPO qualifications
3
DPOs must complete a POTRAZ-approved certification course from an accredited provider and keep certification through CPD.Regs 10(1), 13(1)-(3), SI 155/2024 · source ↗
Registration
3
Controllers processing data of 50 or more people need a POTRAZ licence, tiered USD 50-2,500, renewed every 12 months.Regs 3-9, SI 155/2024 · source ↗
DPIA
2
Regular DPIAs required for children's data; specific-risk processing needs prior Authority authorization. No general DPIA duty.Reg. 10(5)(d), SI 155/2024; s.22 · source ↗
Records
3
Controllers must notify the Authority of all processing activities, including purposes and retention, and keep a breach register.s.21(1); Regs 10(2)(a), 17(4)(b), SI 155/2024 · source ↗
Retention
1
Data may be kept no longer than necessary for the purpose collected; no specific periods.s.13(f) · source ↗
Breaches
Tell the regulator
3
Notify POTRAZ within 24 hours of becoming aware, on Form DP3; investigation report within 21 days.s.19; Reg. 17(1)-(2), (5), SI 155/2024 · source ↗
Tell people
3
Inform data subjects within 72 hours where the breach is likely to result in high risk.Reg. 17(3), SI 155/2024 · source ↗
High-risk trigger with a fixed 72-hour deadline; scored 3 for the fixed deadline.
Transfers
Transfers abroad
2
Transfers abroad need adequate protection in the recipient country or a listed derogation such as unambiguous consent.ss.28-29 · source ↗
Enforcement
Maximum fine
1
Fines up to level 11 (reported at about USD 1,000) and/or up to 7 years' imprisonment.s.33(2); SI 155 offense regs · source ↗
Level 11 dollar value from MISA (secondary); level values change by statutory instrument.
Criminal liability
3
Most breaches of the Act and SI 155 are offenses, carrying up to 7 years' imprisonment; failing to appoint a DPO up to 2 years.s.33; Regs 3(3), 5(3), 10(6), 12(6), 16(7), 17(6), SI 155/2024 · source ↗
Offenses target controllers broadly; no specific officer-liability clause seen.
Private action
1
No statutory compensation right; data subjects complain to POTRAZ, with appeal to the Administrative Court.s.34 · source ↗
Common-law claims may remain available.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws