NewZimbabwe.com has invited Mr. Vengai Madzima, the Senior Partner at Madzima Chidyausiku Museta Legal Practitioners (MCM Legal), to discuss with us legal issues that affect Zimbabweans. The discussions are of a general nature, and those seeking specific legal advice should contact their lawyer.
Reporter: Welcome back, Mr. Madzima. This week we want to discuss compliance with data protection laws: who they apply to and when companies have to comply.
VM: Thank you very much.
We discussed data protection extensively in one of our previous articles; if I am not mistaken, that was around the period the Statutory Instrument was published. However, I will reiterate that the right to privacy and data protection remains a constitutional right.
If we understand this premise, then the compliance requirements will become more palatable.
That being said, all entities that handle personal information relating to customers, suppliers, employees or members of the public, be it government agencies, businesses, universities or financial institutions, are supposed to be compliant with the Cyber and Data Protection Act {Chapter 12:07} and the Cyber and Data Protection {Licensing of Data Controllers and Appointment of Data Protection Officers} Regulations.
So, entities that collect personal information, which may include, but is obviously not limited to, identity details, financial information, health status, employment data et cetera must ensure that their compliance position with our laws is in order before 1 September 2026
I say so because POTRAZ, that is the Post and Telecommunications Regulatory Authority of Zimbabwe, announced that from 1 September, 2026 there will be mandatory data protection inspections and assessments on entities that collect such personal data and are not exempt.
Reporter: What can an entity which potentially falls within the provisions of a data controller do to ensure compliance?
VM: Â Once an entity establishes that it is a data controller and does not operate within the exempted data processing activities, it is required to obtain a data controller licence; these licences vary depending on the volume of data handled.
However, the data controller licences are renewed annually.
Data controllers are also expected to implement systems that ensure that personal data is always protected. In the event of a breach of this fundamental right to privacy, the data controller should report the breach to the Data Protection Authority within 24 hours and if the breach poses a real risk to the personal information held, the affected people must be notified within 72 hours.
Reporter: What data processing activities may be exempted?
VM: Â The regulations have made provisions for certain exemptions in the processing of personal data, which include family issues, specified law enforcement, historical and journalistic activities.
This list is not exhaustive.
Reporter: Are there any other compliance requirements?
VM: Yes.
Entities are supposed to appoint a data protection officer for purposes of monitoring compliance with the law. His or her duties will include conducting compliance audits, training employees on data protection, and being a go- between the entity and Potraz.
This officer will be certified and knowledgeable of the Data Protection laws in Zimbabwe.
Reporter: Are there any further requirements?
VM: Well, what is important to note in the governance of entities that deal with personal data is that data protection is an ongoing obligation and such entities are expected to always deal with the data with due care at all material times.
Due care also includes collecting personal information only for legitimate purposes, securing it and keeping it only for as long as necessary.
Reporter: Thank you, Mr. Madzima. We have run out of time.
VM: Thank you.
You can contact Vengai Madzima on vengai@mcmlegal.co.zw or at www.mcmlegal.co.zw
! Single women are waiting for you on — https://reurl.cc/OQVQdr