Zimbabwe

LawCurrent (amended)· Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as Data Protection Authority

Act 5 of 2021

Zimbabwe Cyber and Data Protection Act [Chapter 12:07]

Prepared by Shubhank Suman · Last reviewed 20 September 2026

Document page

CURRENT / IN FORCE

Legal character: Statute
Region: Africa
Current effective version: As at 11 March 2022 (ZimLII consolidated text)

What it covers

A combined data-protection and cybersecurity statute. It designates POTRAZ as Data Protection Authority and provides for a Cyber Security Centre; sets rules on data quality and processing of sensitive, genetic, biometric and health data; imposes controller and processor duties including security and breach notification; gives data subjects rights including protection against decisions based solely on automated processing; regulates transborder flows; and amends the Criminal Law Code to create cybercrime offences and the Criminal Procedure and Evidence Act for electronic evidence.

Why it matters

It is Zimbabwe's only general data-protection law and its main cybercrime statute.

Refer to it when

Use it for processing personal data in Zimbabwe, cross-border transfers, breaches, automated decisions or cybercrime and electronic evidence.

AI, privacy and cybersecurity relevance

AI: Moderate
Privacy: Very High
Cyber: Very High

MODERATE RELEVANCE

Automated decision-making rules in section 25.

Privacy

VERY HIGH RELEVANCE

Comprehensive data-protection regime.

Cybersecurity

VERY HIGH RELEVANCE

Cyber Security Centre, cybercrime offences and electronic evidence.

Applicability

Data controllers and processors, public and private, processing personal data in Zimbabwe.

Current validity

CURRENT. The PDF is the ZimLII / Laws.Africa consolidated text as at 11 March 2022, not the original Gazette; later amendments or regulations may exist. Read the official PDF on this page for the operative text.

Read first

Part I (ss. 1–4) → Part II Authority → Part IV processing rules → Part V duties and breach notification → Part VI rights and automated decisions → Part VII transborder flows → Part XI cybercrime amendments.

Provisions / sections covered

Part II – Data Protection Authority (ss. 5–6)

POTRAZ designated as Data Protection Authority.

Part IV – Processing rules (ss. 8–12)

Sensitive, genetic, biometric and health data.

Part V – Duties (ss. 13–24)

Controller and processor duties, security and breach notification.

Section 25 – Automated decisions

Limits decisions based solely on automated data processing.

Part VII – Transborder flows (ss. 28–29)

Transfers outside Zimbabwe only with adequate protection or listed exceptions.

Part XI – Amendments (ss. 35–37)

Cybercrime offences and electronic evidence.

Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.

Document page in the Knowledge Base - full text or PDF where it is available for this record.

This library locates primary and official sources. It does not interpret the law and it is not legal advice.