Frequently Asked Questions (FAQ) About Data Protection in Zimbabwe

1. Does Zimbabwe have Data Protection law?

Yes, Zimbabwe does have data protection laws which are:

• the Cyber and Data Act [Chapter 12:07]
• the Data Protection Act [Chapter 11:12]
• The Access to information and Protection of Privacy Act [Chapter 10:27].

The following laws also contribute to data protection laws in Zimbabwe:

• Census and Statistics Act [Chapter 10:29]
• Consumer Protection Act [Chapter 14:14]
• Courts and Adjudicating Authorities (Publicity Restrictions) Act [Chapter 07:04]
• Interception of Communication Act [Chapter 11:20]
• National Registration Act [Chapter 10:17]

2. What is the purpose of the Data Protection Act in Zimbabwe?

The purpose of the Data Protection Act [Chapter 11:12], according to Section 2 of the Data Protection Act [Chapter 11:12] is to increase data protection in order to build confidence and trust in the secure use of information and communication technologies by data controllers, their representatives and data subjects.

3. What are the functions of the Data Protection Authority in Zimbabwe?

The functions of the Data Protection Authority in Zimbabwe are outlined under Section 3 of the Data Protection Act [Chapter 11:12]. These include:

• Regulating a manner in which personal data can be processed through establishing conditions for unlawful data protection.
• Enforcing data protection principles.
• Providing opinion in privacy issues.
• Investigating data breach.
• Raising data protection awareness.

4. What is the GDPR equivalent in Zimbabwe?

The General Data Protection Regulation (GDPR) is a legal framework designed to regulate the collection and processing of personal data from individuals living inside and outside the European Union. The GDPR is equivalent to the Data Protection Act in Zimbabwe.

5. What are the rules of processing of data in Zimbabwe?

Rules on data processing are guided by Section 7 of the Data Protection Act. These rules are as follows:

• The data must be relevant, adequate and not excessive.
• The data must be kept.
• Must be in a form which allows identification.

6. Who enforces data protection in Zimbabwe?

The Postal and Telecommunication Regulatory Authority of Zimbabwe (POTRAZ) as the Data Protection Authority enforces data protection in Zimbabwe.

7. What is a data controller?

A data controller is defined in Section 2 of the Act as a natural person or legal person authorised by authority who determines the means and purpose of processing data.

8. What are the duties of data controllers?

The duties of a data controller are listed under Section 13 of the Data Protection Ac [Chapter 11:12]. These include:

• Ensure that data was processed lawfully and in accordance with the right to privacy.
• Ensure that personal information is accurate and updated.
• Ensure that personal information is collected for legitimate and specified purposes.

9. What constitutes personal information in Zimbabwe?

Section 2 of the Access to Information and Protection of Privacy Act [Chapter 11:12] provides that personal information constitutes of:

• the person's name, address or telephone number.
• the person's race, national or ethnic origin, colour, religious or political beliefs or association
• the person's age, sex, sexual orientation, marital status or family status
• an identifying number, symbol or other particulars assigned to that person
• fingerprints, blood type or inheritable characteristics
• information about a person’s health care history
• information about educational, financial, criminal or employment history.
• anyone else’s opinions.

10. What constitutes sensitive information in Zimbabwe?

Sensitive information is described in section 3 of the Data Protection Act [Chapter 11:12] as information or any opinion about an individual which reveals or contains some of the following—

• racial or ethnic origin
• political opinions
• membership of a political association
• religious beliefs or affiliations
• philosophical beliefs
• membership of a professional or trade association
• sex life
• criminal educational, financial or employment history

11. Are there regulations in Zimbabwe regulating the exchange of personal information?

Yes, in Zimbabwe the exchange of personal information is regulated by the Data Protection Act and the Cyber and Data Protection Act. These regulations put more emphasis on consent of one subject.

12. Is it permissible to transfer personal information outside of Zimbabwe?

Yes, Section 29 of the Data Protection Act [Chapter 11:12] provides that it is permissible to transfer personal information outside Zimbabwe given that the owner of the data has given consent, transfer of the data is necessary for the fulfilment of a contract, the transfer is essential for public interest to mention a few.

13. What is biometric sensitive data and health in Zimbabwe?

Biometric sensitive data are unique physical or biological features which include fingerprints, voice recognition and DNA profiles. Health sensitive refers to one’s physical or mental wellbeing these include medical records or history. Processing biometric and health data is governed under Section 12 of the Data Protection Act [Chapter 11:12].

14. Is there regulation of health data in Zimbabwe?

Yes, Health data is regulated by the Data Protection Act [Chapter 11:12].

15. Can the data of a minor child be collected in Zimbabwe?

Data of a minor child can be collected in Zimbabwe in terms of Section 18 of the Data Protection Act [Chapter 11:12] which provides that “where the data subject is a child, his or her rights pursuant to this law may be exercised by his or her parents or legal guardian.” Meaning that consent for the data to be collected is given by the parents or guardian of that child.

16. Can you sue someone for invasion of privacy in Zimbabwe?

Yes, you can sue someone for invasion of privacy in Zimbabwe. Privacy is a constitutional right protected by section 57 of the Constitution of Zimbabwe.

17. Can a video be used as evidence in court in Zimbabwe?

Yes, a video can be used as evidence in court as accordance to Section 38(2) Criminal and Procedure and Evidence Act [Chapter 9:07]. Furthermore, in the case of S v Japajapa SC 600/23 the issue of admissibility of video evidence was explained.

18. Can you record without consent in Zimbabwe?

No, you can not record without consent under Section 164A of Cyber and Data Act [Chapter 12:07].

19. Can someone post a picture of me without my permission?

Posting someone’s picture without their consent is a criminal offence under the aforementioned section 164A of Cyber and Data Act [Chapter 12:07].

20. Is CCTV footage admissible in Zimbabwean Courts?

Yes, it can be admissible. (Refer to number 18)

21. Can l record a police officer in Zimbabwe?

No provision in the Police Act specifies the legality of recording a police officer. However, Section 184 of the Criminal Codification Reform Act makes it a criminal offense to obstruct the course of justice might it be by recording an investigation or what. On the other hand, we have the goal as a country to be transparent and if for public interest the recording is made to expose police officer’s misconduct it may be another case and can be considered not a crime.

22. Can someone record you without your permission in Zimbabwe?

No, you can not be recorded by someone without your permission or consent that is according to Section 57 of the Zimbabwe Constitution which put emphasis on the right to privacy.

23. Can an employer record audio at the workplace in Zimbabwe?

An employer can record audios at the work place legally given they would not misuse the information. Distributing these recordings without the consent of the parties involved in the audio is what is not permissible.

24. Is Zimbabwe a one-party consent country?

Zimbabwe is a one-party consent country given that the party is the subject to any information being used or distributed.

25. Can l record a phone conversation?

Recording a phone conversation can only be done with legal consent which is called the one- party consent of the party to be recorded.

26. Do you have to tell a customer the call is being recorded?

It is not mandatory but considered good practice in Zimbabwe.

27. How to record a call without an announcement?

It is illegal to record a call without consent of the other subject.

28. How can l tell if someone is recording my phone call?

You can tell someone is recoding your phone call by either a beep tone or announcement, in some instances the sound of the call might be funny and in echoes also behaviour of the other party during the call as they might too formal or too investigative.