Zimbabwe

Sections 7-13 and 17 set the conditions for processing, with written consent required for sensitive, genetic, biometric and health data (ss 11-12). Section 14 gives data subjects rights of information, access, objection, correction and deletion; s 25 covers automated decisions. Section 20 requires prior notification of automated processing and s 23 provides for a register of controllers.

Section 19 requires the controller to notify the Authority within twenty-four hours of any security breach affecting data it processes. POTRAZ's Data Breach Notification and Handling Guideline (CDPG 3 of 2024) asks for written notice using form DP3 within 24 hours of becoming aware of an actual or suspected breach.

Section 25(1) requires institutions to develop and implement programmes to prevent money laundering and terrorist financing, including independent audit arrangements to test their effectiveness (s 25(1)(e)). Section 25(2) requires a compliance officer designated at management level. The RBZ AML/CFT/CPF Guideline (ss 3.22-3.32) adds a direct reporting line to the board.

Section 4.5 states that reporting to the board on climate risk should be done at least quarterly; ss 6.1-6.3 require climate risk disclosures in published financial statements covering governance and strategy and, where material, risk management and metrics.

Section 3A of the Money Laundering and Proceeds of Crime Act requires registration with the Unit, with a fine of up to US$100,000, up to two years' imprisonment, or both for non-compliance (s 3A(3)); providers operating before the Finance Act, 2025 could continue until 30 April 2026 (s 3A(4)); the section was inserted by s 68 of Act 7 of 2025. S.I. 99 of 2026 requires incorporation in Zimbabwe (s 4), a decision within 90 days of a complete application, one-year certificates (s 7) and renewal applications within 90 days before expiry (s 9).