Zimbabwe Data Protection Act (2021)

Zimbabwe

v2021

11 domains

25 controls

The Zimbabwe Data Protection Act (Chapter 11:22) establishes a comprehensive data protection framework for Zimbabwe. It creates the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the data protection authority, establishes data processing principles, and provides for individual rights and enforcement mechanisms.

Verified

Zimbabwe Data Protection Act (2021) is a compliance framework from Zimbabwe with 11 domains and 25 controls. The largest domains are Zimbabwe DPA: Governance and Accountability (5 controls), Zimbabwe DPA: Data Subject Rights (3 controls), Zimbabwe DPA: Lawful Basis and Registration (3 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (11)

Breach

1 controls

Controls in the Breach domain of Zimbabwe Data Protection Act (2021) — 1 controls
Code	Title	Description
ZIMBABWE-5	Breach and Enforcement	Per Zimbabwe Data Protection Act (2021): Breach and Enforcement. Source-grounded summary control covering authoritative...

Governance

1 controls

Controls in the Governance domain of Zimbabwe Data Protection Act (2021) — 1 controls
Code	Title	Description
ZIMBABWE-4	DPO and Governance	Per Zimbabwe Data Protection Act (2021): DPO and Governance. Source-grounded summary control covering authoritative fram...

Rights

1 controls

Controls in the Rights domain of Zimbabwe Data Protection Act (2021) — 1 controls
Code	Title	Description
ZIMBABWE-2	Rights and Notice	Per Zimbabwe Data Protection Act (2021): Rights and Notice. Source-grounded summary control covering authoritative frame...

Scope

1 controls

Controls in the Scope domain of Zimbabwe Data Protection Act (2021) — 1 controls
Code	Title	Description
ZIMBABWE-1	Scope and Lawful Basis	Per Zimbabwe Data Protection Act (2021): Scope and Lawful Basis. Source-grounded summary control covering authoritative...

Security

1 controls

Controls in the Security domain of Zimbabwe Data Protection Act (2021) — 1 controls
Code	Title	Description
ZIMBABWE-3	Security and Cross-Border	Per Zimbabwe Data Protection Act (2021): Security and Cross-Border. Source-grounded summary control covering authoritati...

Zimbabwe DPA: Data Subject Rights

3 controls

Controls in the Zimbabwe DPA: Data Subject Rights domain of Zimbabwe Data Protection Act (2021) — 3 controls
Code	Title	Description
ZDPA-05	Data Subject Rights Handling	Provide data subjects with mechanisms to access, rectify, erase, restrict, object to processing and obtain copies of the...
ZDPA-13	Automated Decision Making and Profiling	Provide data subjects with the right not to be subject to a decision based solely on automated processing, including pro...
ZDPA-15	Children and Vulnerable Persons	Apply additional safeguards when processing personal information of children and other vulnerable persons, including age...

Zimbabwe DPA: Governance and Accountability

5 controls

Controls in the Zimbabwe DPA: Governance and Accountability domain of Zimbabwe Data Protection Act (2021) — 5 controls
Code	Title	Description
ZDPA-03	Appointment of Data Protection Officer	Appoint a Data Protection Officer where the entity is a public body, processes sensitive information at scale or carries...
ZDPA-09	Records of Processing Activities	Maintain written records of all processing activities, including categories of data subjects, categories of personal inf...
ZDPA-10	Data Protection Impact Assessment	Carry out a Data Protection Impact Assessment for processing operations that are likely to result in a high risk to the...
ZDPA-18	Whistleblowing on Data Protection Failures	Provide internal and external channels for staff and contractors to report suspected breaches of the Act without fear of...
ZDPA-19	Awareness and Training	Train all personnel who handle personal information on their obligations under the Act, with role specific modules for h...

Zimbabwe DPA: Lawful Basis and Registration

3 controls

Controls in the Zimbabwe DPA: Lawful Basis and Registration domain of Zimbabwe Data Protection Act (2021) — 3 controls
Code	Title	Description
ZDPA-01	Lawful Basis and Consent for Processing	Establish and document a lawful basis for every processing activity involving personal information of data subjects in Z...
ZDPA-02	Registration of Data Controllers with POTRAZ	Register the entity as a data controller with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ...
ZDPA-04	Sensitive Information Processing Safeguards	Apply heightened safeguards when processing sensitive information including health, genetic, biometric, racial, politica...

Zimbabwe DPA: Marketing, Complaints and Enforcement

3 controls

Controls in the Zimbabwe DPA: Marketing, Complaints and Enforcement domain of Zimbabwe Data Protection Act (2021) — 3 controls
Code	Title	Description
ZDPA-12	Direct Marketing and Electronic Communications	Send unsolicited electronic communications for direct marketing purposes only with the prior consent of the recipient or...
ZDPA-16	Complaints and POTRAZ Cooperation	Provide data subjects with a clear complaints channel that escalates to POTRAZ if unresolved, and cooperate fully with t...
ZDPA-20	Penalty and Enforcement Readiness	Maintain readiness for enforcement action by POTRAZ including production of records, ability to demonstrate accountabili...

Zimbabwe DPA: Security and Breach Notification

3 controls

Controls in the Zimbabwe DPA: Security and Breach Notification domain of Zimbabwe Data Protection Act (2021) — 3 controls
Code	Title	Description
ZDPA-07	Security of Processing	Implement appropriate technical and organisational measures proportionate to the risk of processing, including access co...
ZDPA-08	Personal Information Breach Notification	Detect, assess and notify POTRAZ and affected data subjects of personal information breaches that pose a risk of harm, w...
ZDPA-17	Cybersecurity and Critical Information Infrastructure	Where designated as critical information infrastructure, comply with additional cybersecurity duties under the Act inclu...

Zimbabwe DPA: Transfers, Processors and Retention

3 controls

Controls in the Zimbabwe DPA: Transfers, Processors and Retention domain of Zimbabwe Data Protection Act (2021) — 3 controls
Code	Title	Description
ZDPA-06	Cross-Border Data Transfers	Only transfer personal information outside Zimbabwe to jurisdictions providing an adequate level of protection or under...
ZDPA-11	Processor Obligations and Contracts	Engage processors only under written contracts that bind them to process personal information solely on documented instr...
ZDPA-14	Retention and Disposal	Retain personal information only for as long as necessary for the declared purposes, applying documented retention sched...

What is Zimbabwe Data Protection Act (2021) and who does it apply to?

Zimbabwe Data Protection Act (2021) is a compliance framework from Zimbabwe with 11 domains and 25 controls. The Zimbabwe Data Protection Act (Chapter 11:22) establishes a comprehensive data protection framework for Zimbabwe. It creates the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the data protection authority, establishes data processing principles, and provides for individual rights and enforcement mechanisms. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Zimbabwe Data Protection Act (2021) actually require?

Zimbabwe Data Protection Act (2021) has 25 controls organised across 11 domains. The largest domains are Zimbabwe DPA: Governance and Accountability (5 controls), Zimbabwe DPA: Data Subject Rights (3 controls), Zimbabwe DPA: Lawful Basis and Registration (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Zimbabwe Data Protection Act (2021) do I already cover?

Zimbabwe Data Protection Act (2021) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement Zimbabwe Data Protection Act (2021)?

Start your Zimbabwe Data Protection Act (2021) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Zimbabwe Data Protection Act (2021) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 25 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required