Zimbabwe's data protection law came into operation in March 2022 and applies to almost every business that holds customer or employee information. Here are your practical obligations.
Who the Act applies to
The Act applies to data controllers — anyone who determines how and why personal information is processed. If you hold customer names, employee ID numbers, phone numbers or payment details, you are in scope.
It is regulated by POTRAZ as the Data Protection Authority, and it came into operation in March 2022.
Core principles you must follow
Personal information must be collected lawfully and for a specified purpose, kept accurate and no longer than necessary, and protected by appropriate security measures.
Consent is one lawful basis, but not the only one; contractual necessity and legal obligation also apply, which matters when you are required to collect data to file with the Registrar or ZIMRA.
- Collect only what you need, for a stated purpose
- Tell people what you collect and why
- Keep it accurate and up to date
- Secure it against loss and unauthorised access
- Delete or anonymise it when the purpose ends
Practical steps for a small business
Publish a privacy notice, name someone responsible for data protection, keep a simple record of what you hold and where, restrict access to sensitive files, and have a plan for responding to a breach.
Sensitive categories — including identity documents, financial details and biometric data — deserve stricter controls.
Individual rights and requests
People can ask what you hold about them, request correction, and in defined circumstances request deletion. You need a route for receiving and answering those requests within a reasonable period.
Amashad operates a documented consent and privacy-request process for exactly this reason, and every applicant can view their consent record in their dashboard.
Frequently asked questions
Do small businesses really need to comply?
Yes. The Act applies by activity, not by company size.
Do I need consent for everything?
No. Other lawful bases include contract performance and legal obligations, such as statutory filings.
What happens after a data breach?
Contain it, assess the impact, notify affected parties and the authority where required, and document your response.
This guide is general information, not legal or tax advice. Zimbabwe's principal company law is the Companies and Other Business Entities Act [Chapter 24:31], available at ZimLII.
Next guideCompany Record-Keeping in Zimbabwe: What You Must Keep and For How Long