62%
of Zimbabwe's 21 requirements are already met by European Union (GDPR). Here is what CDPA (Zimbabwe) adds, biggest gaps first.
RegistroGobernanzaBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
CDPA (Zimbabwe) adds3 Controllers processing data of 50 or more people need a POTRAZ licence, tiered USD 50-2,500, renewed every 12 months.
Regs 3-9, SI 155/2024 · source ↗
DPO obligatorioGobernanzaBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
CDPA (Zimbabwe) adds3 Every data controller must appoint a DPO and notify POTRAZ on Form DP2.
s.20(5); Reg. 12(1), SI 155/2024 · source ↗
Requisitos del DPOGobernanzaBig gap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
CDPA (Zimbabwe) adds3 DPOs must complete a POTRAZ-approved certification course from an accredited provider and keep certification through CPD.
Regs 10(1), 13(1)-(3), SI 155/2024 · source ↗
Responsabilidad penalAplicación de la leyBig gap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
CDPA (Zimbabwe) adds3 Most breaches of the Act and SI 155 are offenses, carrying up to 7 years' imprisonment; failing to appoint a DPO up to 2 years.
s.33; Regs 3(3), 5(3), 10(6), 12(6), 16(7), 17(6), SI 155/2024 · source ↗
NiñosAlcance y base jurídicaGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
CDPA (Zimbabwe) adds3 Age 18. Parents or guardians consent and exercise rights; controllers must verify consent and run regular DPIAs for children's data.
s.3; s.26; Reg. 10(5), SI 155/2024 · source ↗
RegistrosGobernanzaGap
GDPR2 Controllers and processors keep records of processing; limited exemption for organizations under 250 employees doing occasional, low-risk processing.
CDPA (Zimbabwe) adds3 Controllers must notify the Authority of all processing activities, including purposes and retention, and keep a breach register.
s.21(1); Regs 10(2)(a), 17(4)(b), SI 155/2024 · source ↗
Informar al reguladorViolaciones de datosGap
GDPR2 Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
CDPA (Zimbabwe) adds3 Notify POTRAZ within 24 hours of becoming aware, on Form DP3; investigation report within 21 days.
s.19; Reg. 17(1)-(2), (5), SI 155/2024 · source ↗
Informar a las personasViolaciones de datosGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
CDPA (Zimbabwe) adds3 Inform data subjects within 72 hours where the breach is likely to result in high risk.
Reg. 17(3), SI 155/2024 · source ↗
Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Rights, Request deadline, Marketing, DPIA, Retention, Transfers abroad, Localization, Maximum fine, Private action.
A gap means CDPA (Zimbabwe) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
