By Jonathan Mbiriyamveka
Zimbabwean businesses face strict new compliance deadlines under the Cyber and Data Protection Act (CDPA), as outlined by POTRAZ Director General Dr Gift Machengete in his recent presentation.
Key deadlines are fast approaching, and failure to meet them could lead to significant penalties, including fines and possible imprisonment for responsible parties.
Dr Machengete emphasized that all data controllers—entities responsible for handling personal information—must be licensed by March 12, 2025. This licensing, valid for 12 months, must be renewed at least three months before expiration.
Additionally, any organization processing personal data must designate a Data Protection Officer (DPO) by December 12, 2024, who will oversee data privacy practices and compliance with the CDPA.
Under the Act, data controllers must act swiftly in the event of a data breach, notifying POTRAZ within 24 hours of awareness.
The law also mandates further investigation within 21 days of a breach and prompt updates to any affected individuals, especially when their personal information might be at risk.
POTRAZ has emphasized these requirements to ensure transparency, integrity, and accountability within Zimbabwe’s data privacy landscape.
“Data privacy is both a technical and ethical commitment that Zimbabwean companies must make to their stakeholders,” Dr Machengete explained.
Non-compliance could expose companies to steep regulatory fines, reputation damage, and even operational disruptions.
With this roadmap, POTRAZ is aiming to ensure a smooth transition for companies toward robust data governance, which Dr Machengete says is vital for Zimbabwe’s modernization and economic growth.
About Author
