Hacking. Unauthorised access: fine Level 10 or five years.
Offences and penalties · CDPA Section 33
The Act combines administrative fines for organisations with criminal liability for individuals. This guide summarises the main exposure.
The Cyber and Data Protection Act applies administrative fines to the entity and criminal imprisonment to individuals. Violating the sections on sensitive data (Section 11), security duties (Section 18) or transborder flow (Section 28) carries fines up to Level 11 and imprisonment for up to seven years (Section 33).
Hacking. Unauthorised access: fine Level 10 or five years.
Unlawful acquisition of data. Intercepting private transmissions: fine Level 14 or five years.
Transmission of intimate images (164E). Distribution without consent to cause humiliation: five years.
Aggravating circumstances (163F). Penalties rise to Level 14 fines or 20 years’ imprisonment where the offence involves essential services such as banking or electricity, State security, or causes considerable economic loss.
Section 33(1) extends personal liability to staff, contractors and experts of the Authority and of the controller. That exposure makes internal whistleblowing systems (Section 31) and robust training a practical necessity for employees and executives.
Compliance is an ongoing duty. Start by understanding your gaps with a CDPA assessment, appoint an independent Data Protection Officer, meet the 24-hour breach reporting rule, and train leadership through CDPA executive training.
Violating the sections on sensitive data, security duties or transborder flow carries fines up to Level 11 and imprisonment for up to seven years (Section 33).
Yes. Section 33(1) extends personal liability to staff, contractors and experts of the Authority and the controller.
Under Section 163F of the Criminal Law Code, penalties rise to Level 14 fines or 20 years’ imprisonment where essential services or State security are involved, or where the offence causes considerable economic loss.
How to Register as a Data Controller in Zimbabwe The five-step POTRAZ licensing process, Form DP1, required documents and renewal rules. Read the guide.
Data Protection Officer (DPO) in Zimbabwe What a DPO does, when you need one, Form DP2 and why independence matters. Read the guide.
Data Breach Notification in Zimbabwe The 24-hour rule, Form DP3, and what to prepare before a breach happens. Read the guide.
Data Subject Rights Under the CDPA The five core rights, consent rules, children’s data and direct marketing. Read the guide.
PrivacyCure completes Form DP1, assembles the application pack, names a certified Data Protection Officer and keeps your filing aligned with the Act and its regulations. Email dpo@privacycure.com or use the contact page.
Information only, not legal advice. Statutory references follow the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024. Confirm current requirements with POTRAZ or a qualified adviser before you file or act.