Cyber and Data Protection Act

The Cyber and Data Protection Act [Chapter 12:07] (Act No. 5 of 2021) regulates the processing of personal information in Zimbabwe, establishing the Postal and Telecommunications Regulatory Authority as the Data Protection Authority and setting out the rights of data subjects, the duties of data controllers and processors, rules on cross-border data transfers, and offences relating to cybercrime, data breaches and electronic communications. NANGO shares this legislation as a resource for member organisations to strengthen understanding of their obligations around the collection, processing and protection of personal data, particularly given the sector's handling of beneficiary and stakeholder information. Members are encouraged to review the Act, available in full below, and to align internal data protection practices with its requirements.