Zimbabwe

Section 4(2)(b) of the Cyber and Data Protection Act uses a 'means used' test, not the targeting test familiar from Europe. That is narrower on paper: a purely foreign service with no equipment in Zimbabwe is arguably outside it. But 'means' is undefined, and the regulator's own Regulatory Notice 1 of 2026 reads the licensing duty as extending beyond entities permanently established in the country. Section 4(3) requires a representative established in Zimbabwe whenever subsection (2)(b) bites. Statutes in Zimbabwe do not bind the State unless they say so, and this one does not, so government ministries and agencies arguably fall outside the licensing duty even though the regulator's guidance says otherwise.

Sections 28 and 29 of the Act set the frame: no transfer unless an adequate level of protection is ensured in the recipient country, with six narrow escape hatches in section 29 (consent, contract necessity, third-party contract in the person's interest, public interest or legal claims, vital interests, and public registers). The regulator's Implementation Guideline on Cross Border Transfer of Personal Information (CDPG 5 of 2024, issued 13 November 2024) goes considerably further than the statute, treating cloud hosting, offshore processors, intra-group databases and offshore staff access as transfers. Two dormant switches sit in section 28: subsection (3) lets the regulator declare categories of processing for which transfer abroad is simply not authorised — no such list was found as of August 2026 — and subsection (4) lets the Minister responsible for the presidential Cyber Security and Monitoring Centre issue directions on how transfers are to be handled. Sector position: no localisation was found in banking, insurance, securities, health, gaming or mapping. The central bank's July 2026 digital financial services guideline says data residency 'must comply with RBZ-defined jurisdictional requirements' but does not state what those requirements are, and no separate instrument defining them was located.

The regulator's guideline states that controllers 'are prohibited from cross-border data transfers unless they have notified the Authority' and refers to 'the letter requesting prior authorization', which in practice makes this a permission regime rather than a notification one. The five preconditions are: a data protection impact assessment submitted with the notification; express consent after disclosure of the destination country, the recipient organisation, the security measures, the storage location and the storage duration; a demonstration of adequacy judged on the destination's laws, its supervisory authority and its international commitments; documented organisational and technical measures; and a data-sharing agreement containing a specific data protection clause. Consent is not needed where the transfer is necessary for a contract with the person, for an important public interest or legal claims, or comes from a public register — but the regulator must still be notified. Two important gaps: no adequacy list has been published, so 'adequate protection' is assessed transfer by transfer, and the guideline itself is not law. It is issued under a power in section 28(3) that allows the regulator to say where transfers are NOT authorised, which is not obviously wide enough to support a general prior-authorisation requirement. Treat it as binding in practice and arguable in court.

Section 5 of the Act designates the Postal and Telecommunications Regulatory Authority of Zimbabwe as the Data Protection Authority. Observable evidence of activity as of August 2026: an inaugural licence handover on 6 June 2025 attended by more than 500 delegates at which 570 licences were issued to law firms, medical practices, municipalities, schools, churches, homeowners' associations, parastatals and ministries; a live licensing portal at dclicensing.potraz.zw; guidelines on licensing, data protection officers, consent, breach notification, cross-border transfer and children's data; a 2026 data protection officer training calendar; a new board announced in March 2026; and Regulatory Notice 1 of 2026 chasing unlicensed organisations. Independence is a fair question rather than a settled fact: section 6(2) says the Authority is not subject to direction when acting as data protection authority, but the POTRAZ board is appointed by the President and must comply with the responsible Minister's general policy directives under the Postal and Telecommunications Act. Separately, the Cyber Security and Monitoring of Interception of Communications Centre sits inside the Office of the President; it has no public website and publishes nothing, so its activity cannot be observed. Rated 'waking' rather than 'active' because the licensing machine is clearly running while the sanction machine has produced no visible output.

Floor: the tax authority states that business records including ledgers, invoices, credit and debit notes and computer records must be kept for a minimum of six years, be open to inspection by an officer, and be retrievable in original or copied form, including from a computer or related media. That is an access duty rather than a storage-location duty, but in practice it means offshore archives must be producible on demand. The Reserve Bank's July 2026 digital financial services guideline requires at least five years of archived immutable security logs for incident investigation and regulatory audit, plus quarterly breach and risk exposure summaries. Ceiling: section 7(1)(c) and section 13 of the Act both require data to be retained in identifiable form for no longer than necessary for the purpose. No fixed maximum period is set anywhere. Note that the deletion right in section 14 is unusually narrow — it covers only 'false or misleading' data about the person, not a general right to erasure — so the ceiling is enforced by the regulator rather than by individuals.

Clock one: section 19 of the Act requires notification to the Authority within 24 hours of any security breach affecting data the controller processes; the regulator's breach guideline reads this as running from awareness of an 'actual or suspected' breach, and oral notification is not accepted — it must be Form DP3 addressed to the Director-General. Clock two: regulation 17(3) of Statutory Instrument 155 of 2024 requires the controller to inform affected individuals within 72 hours where the breach is likely to result in a high risk to their rights and freedoms. Clock three: the Reserve Bank requires all banking institutions, non-bank financial institutions, controlling companies and payment system providers to report confirmed cybersecurity incidents within three hours of detection, a deadline repeated in the July 2026 digital financial services guideline for fraud, platform downtime and customer data compromise, with a table of sanctions that puts 'failure to report within 3hrs' in the severe band alongside suspension of services and licence revocation. The 24-hour and 3-hour clocks are the ones that break operations: a Zimbabwean bank suffering a data breach at 6pm on a Friday owes the central bank a report by 9pm that night and the data regulator a completed form by 6pm Saturday.

Trap one, licensing: Statutory Instrument 155 of 2024 makes it an offence to process personal information without a data controller licence. Licences run twelve months and renewal must be applied for at least three months before expiry. Tiers are by headcount of data subjects — Tier 1 (50 to 1,000) costs US$50, Tier 2 (1,001 to 100,000) US$300, Tier 3 (100,001 to 500,000) US$500 and Tier 4 (over 500,000) US$2,500, plus a US$30 application fee for Tiers 2 to 4. Only personal or household use, law enforcement and journalistic, historical or archival purposes are exempt, and the last two must still register. Trap two, the data protection officer: one had to be appointed within 90 days of the regulations, must hold skills in data science, analytics, information security, systems audit, law or audit, must complete a regulator-approved certification course at US$1,250 for Zimbabweans or US$1,450 for foreigners, and must be kept in continuing professional development at the employer's cost. Changes of officer or of the officer's contact details must be notified within 14 days. Trap three, children: the Act defines a child as anyone under eighteen and the regulations forbid processing children's data without a parent or guardian's consent, require reasonable verification of that consent, require regular impact assessments, and ban automated decisions affecting children's rights. Trap four, criminal exposure: section 33 makes contravention of the sensitive-data, controller-duties, security, accountability and cross-border rules an offence carrying up to seven years' imprisonment, and a court may order seizure and destruction of the media holding the data even if it belongs to someone else. The level 11 fine ceiling is only US$1,000 under the standard scale set in February 2023, so the deterrent is the prison term and the seizure power, not the money. Trap five, drafting quality: section 4(1) says the Act must be read alongside a 'Protection of Personal Information Act [Chapter 10:27]' — no statute of that name exists; Chapter 10:27 was the Access to Information and Protection of Privacy Act. The government's own National ICT Policy cites the Act under the wrong chapter number, 11:12. Guidelines are doing a lot of work that the statute does not clearly authorise, and they are not law.

Confirmed pipeline. First, the inspection campaign from 1 September 2026, with a published priority order: financial institutions, insurance companies, local authorities, health care providers, mining enterprises, religious organisations, schools and tertiary institutions and professional bodies, government ministries departments and agencies, then non-governmental and private voluntary organisations. Second, the National Artificial Intelligence Strategy 2026-2030, launched under the President's foreword, commits to upgrading national data centres to Tier IV and building 'data localisation policies', and defines data sovereignty as 'insisting that critical data must reside on local, secure infrastructure'. Third, the National ICT Policy 2022-2027 flags a possible requirement for end-to-end encryption of sensitive data with local hosting of the encryption keys, and separately proposes moving the data protection mandate out of POTRAZ into a standalone authority. Dormant switches that could change the picture overnight, with no consultation: section 28(3) lets POTRAZ declare categories of processing for which transfer abroad is not authorised; section 28(4) lets the Minister responsible for the presidential Cyber Security and Monitoring Centre issue directions on how transfers out of Zimbabwe are implemented; and the Reserve Bank's July 2026 guideline already refers to 'RBZ-defined jurisdictional requirements' for data residency that have not yet been defined, so the central bank can turn on a financial-sector residency rule by circular.