Cyber security compliance in Zimbabwe

Which cyber and data protection laws apply in Zimbabwe?

The Cyber and Data Protection Act [Chapter 12:07], Act 5 of 2021, is the core law. It designates POTRAZ, the Postal and Telecommunications Regulatory Authority of Zimbabwe, as the Data Protection Authority, sets the rules for processing personal information, and moved computer crime offences into the Criminal Law (Codification and Reform) Act rather than creating a separate cybercrime statute. SI 155 of 2024 adds licensing of data controllers and the appointment of data protection officers. Banks and payment providers also answer to the Reserve Bank of Zimbabwe.

What does SI 155 of 2024 require?

The Regulations took effect on 13 September 2024. Data controllers need a licence from POTRAZ, renewed every 12 months, with fees from US$50 to US$2,500 by tier; POTRAZ says any organisation processing the personal information of 50 or more people generally needs one, and the licensing deadline was 12 March 2025. Existing controllers had to appoint a data protection officer and notify POTRAZ within 90 days, and the officer must complete a certification course approved by the Authority.

A security breach must be notified to POTRAZ within 24 hours under section 19 of the Act, and affected data subjects within 72 hours under the Regulations. Offences under the Regulations carry fines of up to level 11 or imprisonment of up to seven years, and POTRAZ has warned that company executives can face criminal liability.

What happens in a POTRAZ compliance inspection?

Regulatory Notice 2 of 2026 started mandatory compliance inspections on 1 September 2026 for organisations that collect or process personal information. They are risk-based, and the sectors named for priority include financial institutions, insurers, healthcare providers, local authorities, schools and tertiary institutions, mining companies, religious organisations and government ministries. Inspectors look at licensing, security measures and data governance practices.

An inspection is easiest to pass with records that already exist: the licence and its renewal, the data protection officer's appointment and certificate, the processing records, the security measures and the breach log. GRCLens keeps each of these as evidence on the control it supports.

What does the Reserve Bank of Zimbabwe require?

The Cybersecurity and Resilience Guideline, published in August 2025, updates the risk-based framework the Reserve Bank first issued in April 2021. It applies to banking institutions, non-bank financial institutions, controlling companies and payment system providers, and expects board oversight, a chief information security officer, a cybersecurity strategy reviewed at least annually, an independent cyber resilience review at least annually, internal cybersecurity audits at least twice a year, an external security assessment and penetration testing at least once a year, and reporting of all cyber incidents to the Reserve Bank within 3 hours, or as soon as the institution becomes aware of an attack.

The sector has been hit before: ZB Financial Holdings was reported in August 2024 to have suffered a ransomware attack in which customer and operational data was leaked.

Why mining matters: platinum and lithium

Platinum group metals are mined on the Great Dyke by producers including Zimplats, Unki and Mimosa, and lithium output has grown quickly. The government has announced a ban on exporting lithium concentrate from 2027 to push processing into the country, which means more plants, more control systems and more connected operational technology.

Mining companies are on POTRAZ's priority list for inspections, so mines need data protection records as well as safety and environmental ones. Zimplats and Mimosa hold ISO 45001 certification, and IEC 62443 provides the security requirements for the control systems that run concentrators and processing plants. Sibanye-Stillwater, a co-owner of Mimosa, reported a cyberattack that affected its IT systems globally in July 2024.

How GRCLens runs Zimbabwe frameworks together

The Cyber and Data Protection Act, the Reserve Bank guideline, ISO/IEC 27001 and IEC 62443 share one control model in GRCLens, so a bank, insurer or mine evidences access control, incident response or supplier assurance once for POTRAZ, the Reserve Bank and its certification body. The 3-hour Reserve Bank notice, the 24-hour POTRAZ notice, the 72-hour notice to data subjects and the annual licence renewal are tracked as their own items. GRCLens can run in your own private cloud or fully on-premises in Zimbabwe.

Official portals and publications

• POTRAZ, Data Protection Authority
• Reserve Bank of Zimbabwe, Cybersecurity and Resilience Guideline (August 2025)