Zimbabwe

The Cyber and Data Protection Act asks where your equipment is. It does not ask who you are aiming at, which is the test Europe uses. Zimbabwe's test is narrower on paper. A foreign service with no equipment in Zimbabwe can argue it falls outside the law. But the law never says what counts as equipment. And the regulator's own Regulatory Notice 1 of 2026 reads the licence duty as reaching beyond companies permanently based in the country. Whenever the equipment test catches you, you must appoint a representative based in Zimbabwe. There is one more gap. Zimbabwean laws do not bind the State unless they say so, and this one does not. So government ministries and agencies can argue they need no licence, even though the regulator's guidance says they do.

The Cyber and Data Protection Act sets the rule. Data may not leave unless the country receiving it protects that data well enough. There are six narrow exceptions. They cover consent, a contract with the person, and a contract with someone else made in the person's interest. They also cover public interest or legal claims, saving someone's life, and data from public registers. The regulator's guideline on sending data abroad, issued on 13 November 2024, goes well beyond the Act. It treats cloud hosting as a transfer. It does the same for suppliers abroad, shared group databases, and staff logging in from other countries. The Act also holds two powers nobody has used yet. The regulator can name kinds of data work whose data may not go abroad at all. We found no such list as of August 2026. The second power belongs to the Minister in charge of the Cyber Security and Monitoring Centre. That centre sits in the President's Office. The Minister can issue directions on how transfers are handled. By industry: we found no rule forcing data to stay in Zimbabwe in banking, insurance, securities, health, gaming or mapping. The central bank's July 2026 guideline on digital financial services says where data sits must follow requirements the Reserve Bank of Zimbabwe defines. It does not say what those requirements are, and we found no separate document setting them out.

The regulator's guideline says you may not send data abroad unless you have told the Authority first. It also refers to the letter asking for permission in advance. So this works as a permission system, not a simple notice. There are five things you must have. One: a data protection impact assessment, sent in with your notice. Two: express consent. You give the person the destination country, the company receiving the data, the security measures, where it will be stored and for how long. Three: proof that the destination country protects data well enough. That is judged on its laws, its data regulator and its international promises. Four: written records of your security measures, both organisational and technical. Five: a data-sharing agreement with a specific data protection clause in it. You do not need consent where the transfer is needed for a contract with the person, for an important public interest, or for legal claims. You also do not need it where the data comes from a public register. You must still tell the regulator. Two gaps matter. There is no published list of approved countries, so each transfer is judged on its own. And the guideline is not law. It rests on a power that lets the regulator say where transfers are not allowed. That power does not obviously stretch to demanding permission for every transfer. The regulator applies the guideline anyway, so follow it. A court might not agree with all of it.

The Cyber and Data Protection Act makes the Postal and Telecommunications Regulatory Authority of Zimbabwe the data protection authority. Here is what we can see it doing as of August 2026. It held its first licence handover on 6 June 2025, with more than 500 people there, and gave out 570 licences. They went to law firms, medical practices, municipalities, schools, churches, homeowners' associations, state-owned companies and ministries. It runs a live licensing portal at dclicensing.potraz.zw. It has published guidelines on licensing, data protection officers, consent, breach reporting, sending data abroad and children's data. It has a 2026 training calendar for data protection officers. It announced a new board in March 2026. And it published Regulatory Notice 1 of 2026, chasing organisations with no licence. Its independence is an open question rather than a settled fact. The Act says the Authority takes no direction from anyone when it acts as the data protection authority. But the President appoints its board. It must also follow the responsible Minister's general policy directions under the Postal and Telecommunications Act. There is also the Cyber Security and Monitoring of Interception of Communications Centre. It sits inside the Office of the President. It has no public website and publishes nothing, so we cannot see what it does. We call enforcement 'waking' rather than 'active'. The licensing side is clearly running. The punishment side has produced nothing we can see.

The minimum comes from tax law. The tax authority says business records must be kept for at least six years. That covers ledgers, invoices, credit and debit notes and computer records. An officer must be able to inspect them. You must be able to produce them, as originals or copies, including from a computer or similar media. This is a rule about access, not about where the data sits. But it does mean an archive held abroad has to be produced on demand. The Reserve Bank of Zimbabwe's July 2026 guideline on digital financial services adds another minimum. It requires at least five years of archived security logs that cannot be altered. They are used for incident investigation and regulator audits. It also requires quarterly summaries of breaches and risk exposure. The maximum comes from the Cyber and Data Protection Act. Data must not be kept in a form that identifies people for longer than the purpose needs. No fixed maximum period is set anywhere. One point about deletion. The right to have data deleted is unusually narrow here. It covers only false or misleading data about the person. It is not a general right to be erased. So the maximum is enforced by the regulator, not by the people whose data you hold.

Clock one. The Cyber and Data Protection Act gives you 24 hours to tell the Authority about any security breach affecting data you hold. The regulator's breach guideline starts that clock when you become aware of a breach, actual or suspected. A phone call does not count. You must send Form DP3, addressed to the Director-General. Clock two. The 2024 regulations give you 72 hours to tell the people affected. That applies where the breach is likely to put their rights and freedoms at high risk. Clock three. The Reserve Bank of Zimbabwe sets a three-hour deadline. It applies to banks, non-bank financial institutions, controlling companies and payment system providers. They must report a confirmed cyber security incident within three hours of spotting it. Its July 2026 guideline on digital financial services repeats that deadline. The deadline covers fraud, platform downtime and customer data being exposed. Its list of punishments puts failure to report within 3 hours in the severe band, alongside suspension of services and losing your licence. The 24-hour and 3-hour clocks are the ones that break operations. A Zimbabwean bank hit by a data breach at 6pm on a Friday owes the central bank a report by 9pm that night. It owes the data regulator a completed form by 6pm on Saturday.

Trap one is the licence. The 2024 regulations make it a crime to hold personal information without one. A licence lasts twelve months, and you must apply to renew at least three months before it expires. The price depends on how many people you hold data about. Tier 1 covers 50 to 1,000 people and costs 50 US dollars. Tier 2 covers 1,001 to 100,000 people and costs 300 US dollars. Tier 3 covers 100,001 to 500,000 people and costs 500 US dollars. Tier 4 covers more than 500,000 people and costs 2,500 US dollars. Tiers 2 to 4 pay a 30 US dollar application fee on top. The only exemptions are personal or household use, law enforcement, and journalism, history or archiving. The last two still have to register. Trap two is the data protection officer. You had 90 days from the regulations to appoint one. They must have skills in data science, analytics, information security, systems audit, law or audit. They must pass a certification course approved by the regulator. It costs 1,250 US dollars for Zimbabweans and 1,450 US dollars for foreign nationals. You then pay for their continuing training. If you change officer, or their contact details change, you must tell the regulator within 14 days. Trap three is children. The Act says a child is anyone under eighteen. You cannot handle a child's data without a parent's or guardian's consent. You must take reasonable steps to check that the consent is real. You must run regular impact assessments. And software alone cannot make decisions that affect a child's rights. Trap four is criminal exposure. Breaking the rules on sensitive data, on your own duties, on security, on accountability, or on sending data abroad is a crime. It carries up to seven years in prison. A court can also seize and destroy whatever the data is stored on, even if that equipment belongs to someone else. The top fine is only 1,000 US dollars under the standard scale set in February 2023. So the deterrent is prison and seizure, not money. Trap five is that the law itself is badly drafted. The Act says it must be read alongside a 'Protection of Personal Information Act [Chapter 10:27]'. No law of that name exists. Chapter 10:27 was the Access to Information and Protection of Privacy Act. The government's own National Information and Communication Technology Policy cites the Act under the wrong chapter number, 11:12. The guidelines carry a lot of weight that the Act does not clearly give them, and guidelines are not law.

Three things are confirmed. First, the inspection campaign starting 1 September 2026. The published order is financial institutions, insurance companies, local authorities, health care providers, mining businesses, religious organisations, schools, colleges and professional bodies. After those come government ministries, departments and agencies. Last come non-governmental and private voluntary organisations. Second, the National Artificial Intelligence Strategy for 2026 to 2030, launched with a foreword by the President. It promises to upgrade the national data centres to Tier IV. It promises policies to keep data in the country. And it says critical data must sit on local, secure infrastructure. Third, the National Information and Communication Technology Policy for 2022 to 2027. It raises a possible rule that sensitive data must be encrypted end to end, with the keys held in Zimbabwe. It also proposes taking data protection away from the telecoms regulator and giving it to a separate authority. Three unused powers could change things overnight, with no public consultation. The telecoms regulator can name kinds of data work whose data may not go abroad at all. The Minister in charge of the Cyber Security and Monitoring Centre can issue directions on how transfers out of Zimbabwe are handled. That centre sits in the President's Office. And the Reserve Bank of Zimbabwe's July 2026 guideline already points to requirements about where data must sit. It has not defined them yet. It could switch them on for banks and payment firms with a single circular.