By Amos Jakarasi, Legal Practitioner, Madzima & Company Law Chambers; formerly Public Prosecutor in the Magistrates Court and the High Court (Money Laundering and Asset Forfeiture Unit)
“Data is the new capital. Those who guard it well will be trusted with more of it.”
For more than a decade, Zimbabwean commerce moved online faster than the law could follow. Mobile money, point-of-sale payments, cloud accounting and customer databases became the arteries of business, while the legal framework governing them remained, at best, a patchwork. That changed in December 2021 with the promulgation of the Cyber and Data Protection Act [Chapter 12:07].
The Act has been received with mixed feelings. Civil society has voiced legitimate concern about its implications for free expression. Yet for the business community, it would be a mistake to read the Act merely as a compliance burden to be endured. Properly understood, it is a charter for trust: a framework within which a business can protect its most valuable intangible asset, the personal data of its customers, and turn that protection into a competitive advantage.
This article sets out the framework, the obligations it imposes, and the ways in which a well-advised business can convert compliance into commercial strength.
I. The Legal Framework
The Act. The Cyber and Data Protection Act [Chapter 12:07] does three things at once. It establishes a data protection regime governing how personal information is collected, used, stored and shared. It strengthens the law on cybercrime, amending the Criminal Law (Codification and Reform) Act to address offences committed through computer systems. And it modernises the rules on the investigation of cybercrime and the admissibility of electronic evidence.
The regulator. The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is designated as the Data Protection Authority. It licenses data controllers, approves codes of conduct, receives breach notifications and enforces compliance.
The 2024 Regulations. In September 2024 the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, Statutory Instrument 155 of 2024, gave the Act its operational teeth. In summary:
- Licensing. Any person who determines the purposes and means of processing personal data, and particularly one who uses it for commercial gain, must hold a data controller’s licence from POTRAZ. Licences are tiered by the number of data subjects, run for twelve months and must be renewed in good time.
- Data Protection Officers. Every licensed controller must appoint a suitably qualified and certified Data Protection Officer to monitor compliance and protect the rights of data subjects.
- Breach notification. A breach must be reported to POTRAZ within 24 hours of the controller becoming aware of it, and affected individuals informed within 72 hours where the breach poses a high risk to their rights.
In short, data protection in Zimbabwe is no longer a matter of best practice. It is a licensed, regulated and enforceable obligation.
II. The Core Obligations
Know your role. The Act distinguishes the data subject, the identifiable person to whom the data relates, from the data controller, who decides why and how the data is processed, and the data processor, who processes it on the controller’s behalf. Banks, insurers, mobile network operators, retailers, schools, hospitals and, indeed, law firms are data controllers many times over. Identifying which hat a business wears in each relationship is the first step to compliance.
Consent is the foundation. Personal information is to be processed with the informed consent of the data subject, or on another lawful basis. The categories are broad: names, identity numbers, addresses, next-of-kin and contact details, marital status, purchasing preferences, biometric data and CCTV footage. Sensitive data, such as health information, demands a higher standard: consent should be express and recorded in writing. A well-drafted consent form, clear on what is collected and why, is the simplest and most effective compliance instrument a business can adopt.
Security is non-delegable in substance. A controller must keep personal data secure, accurate and confidential, through appropriate technical and organisational measures. Where it engages a data processor, such as a payroll bureau, cloud provider or IT contractor, it must choose one that offers sufficient security guarantees and bind it by written contract to the controller’s instructions. A well-drawn processing agreement allocates risk, sets security standards and gives the controller recourse when the processor falls short.
Codes of conduct. The Act allows bodies representing data controllers in a sector to prepare codes of conduct and submit them to the Data Protection Authority for approval. Within a single business, an internal ICT and data-handling code serves the same purpose: it tells employees exactly what is expected of them and limits the employer’s exposure when an individual acts carelessly or dishonestly.
III. From Compliance to Competitive Advantage
Trust as currency. Customers increasingly choose whom to deal with by asking a simple question: will my information be safe? A business that can answer with a licence, a named Data Protection Officer, a clear privacy notice and a record of no breaches is selling more than its product. It is selling assurance. In banking, insurance, health, education and professional services, that assurance is itself a market differentiator.
A cautionary tale from across the Limpopo. In Hawarden v Edward Nathan Sonnenbergs Inc [2023] ZAGPJHC 14, a purchaser of property paid R5.5 million into a fraudster’s account after an email carrying the conveyancers’ banking details was intercepted and altered. The High Court held the law firm liable, reasoning that it knew of the risk of business email compromise and had failed to warn or protect against it. In June 2024 the Supreme Court of Appeal reversed that decision, holding that the purchaser, who had herself been warned and could have verified the account by telephone, must bear the loss (SCA judgment, 2024).
The lesson does not lie in which party ultimately paid. It lies in the fact that a single altered email consumed years of litigation, millions in exposure and the reputations of everyone involved. South African authority is persuasive rather than binding here, but the commercial reality is identical: the business that sends payment details securely, warns its clients, and insists on independent verification is the business that never becomes a case name.
Protecting reputation. The Act also equips businesses to defend themselves. By amending the Criminal Law Code, it criminalises the deliberate transmission of false data messages intended to cause harm. A business targeted by a malicious online campaign is no longer without recourse.
Compliance as a selling point. Tenders, banking relationships and cross-border partnerships increasingly ask for evidence of data protection compliance. A licensed controller with documented policies is ready when that question comes; a competitor without them is not.
IV. A Compliance Roadmap for Boards and Owners
For most businesses, compliance can be achieved in seven disciplined steps:
Map your data. Record what personal data you hold, where it comes from, where it is stored, who can access it and with whom it is shared.- Obtain your licence. Determine your tier by the number of data subjects and apply to POTRAZ. Diarise the renewal date.
- Appoint a Data Protection Officer with the required qualifications and certification, and give that officer genuine authority and access to the board.
- Fix your paperwork. Adopt a privacy notice, consent forms that distinguish ordinary from sensitive data, and written processing agreements with every service provider who handles your data.
- Secure your systems. Implement access controls, multi-factor authentication, encryption and regular backups, and test them.
- Train your people. Adopt an internal ICT and data-handling code. Most breaches begin with human error; most frauds begin with a convincing email.
- Prepare for the worst. Put a breach-response plan in place now, so that the 24-hour notification to POTRAZ is a procedure, not a panic.
On payments in particular: never change a supplier’s or client’s bank details on the strength of an email alone. Confirm by telephone, on a number you already hold. Send your own banking details by a secure channel, and tell your clients, in writing, that you will never change them by email.
Conclusion
The Cyber and Data Protection Act asks businesses to do what prudent businesses should already be doing: to know what they hold, to guard it well, and to answer for it when things go wrong. Those who treat the Act as paperwork will comply grudgingly and at the last minute. Those who treat it as strategy will find that the same measures that satisfy the regulator also win the confidence of customers, banks and partners.
The question is no longer whether to comply, but whether to comply well.
Madzima & Company Law Chambers advises businesses on data protection licensing, consent and privacy documentation, processing agreements, breach response, and disputes arising from cyber fraud. Message us on WhatsApp or call our Harare chambers on +263 242 706725.
Chat with the author on WhatsApp
About the author. Amos Jakarasi is a Legal Practitioner at Madzima & Company Law Chambers. He previously served as a Public Prosecutor in the Magistrates Court and in the High Court, where he worked in the Money Laundering and Asset Forfeiture Unit. His practice draws on that experience in financial crime, cybercrime and asset recovery, and he was named Best Criminal Litigator at the firm’s 2024 Senior Partner’s Awards.
This article provides general information on Zimbabwean law and does not constitute legal advice. Each matter turns on its own facts. For advice on your particular circumstances, consult a registered legal practitioner.
