Introduction
The Data Protection Act [Chapter 11:12] (Data Protection Act) was gazetted on the 3^rd of December 2021, and effectively came into force on the same day. In essence, the new data protection law mandates all business operating in Zimbabwe (and outside) to adhere to data protection and privacy principles when collecting data such as personal information of their customers or employees. In keeping abreast with new technology, businesses are therefore required to ensure that they implement systems which promote and protect data privacy as well as processing data fairly and securely. In this article, we provide a general overview of the provisions of the Data protection law.


Objectives
In terms of section 2 of the Data Protection Act, the main objective of the data protection law is to increase data protection in order to build confidence and trust in the secure use of information and communication technologies by data controllers, their representatives and data subjects.


Application
In terms of section 4, the Data Protection Act applies to matters relating to access to information, protection of privacy of information and processing and storage of data wholly or partly by automated means. The law further applies to all entities in Zimbabwe and those not permanently domiciled in Zimbabwe.


Key Provisions
Section 3 of the Data Protection Act, defines data as any representation of facts, concepts, information, whether in text, audio, video, images, machine-readable code or instructions, in a form suitable for communications, interpretation or processing in a computer device, computer system, database, electronic communications network or related devices and includes a computer programme and traffic data.

The Act also defines a data controller as any natural person or legal person who is licensable by the Data Protection Authority which includes public bodies and any other person who determines the purpose and means of processing data. The data controllers are required to ensure that the processing of data is necessary and that data is processed fairly and lawfully

The Data Protection Act establishes the Data Protection Authority (the Authority) that is, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which is the current regulator of the telecommunications industry.

The Act provides a guideline of how data controllers are to process non-sensitive and sensitive information. The Act deals with trans-border flow of data meaning the transfer of personal information outside Zimbabwe.

The Data Protection Act amends the provisions of sections 163-166 of the Criminal Law (Codification and Reform) Act [Chapter 9:23] by criminalising offences such as unlawful acquisition of data, unlawful interference of data, unlawful disclosure of data and data codes. As regards the offences relating to electronic communications, the Act prohibits the transmission of data messages inciting violence or damage of property, sending threatening data messages, hacking, spam, cyber-bullying and harassment, posting of sexually explicit content without consent of the data subject. These criminal activities attract penalties in the form of fines and custodial sentences ranging from teen to fifteen years.


Conclusion
While some institutions may adopt international best practice on collecting and processing confidential information there remains a need to enhance the enforcement data privacy and data protection. The new data protection law thus seeks to consolidate the framework for the protection of privacy and personal data rights. The new data protection law is therefore a commendable step in realising privacy rights and the protection of personal data in Zimbabwe.