Security measures (Section 18). Controllers must implement technical and organisational measures to safeguard data against unauthorised access, accidental loss or alteration. The required level is “appropriate” to the risk.
Security breaches · CDPA Sections 18 and 19
Controllers must tell POTRAZ about a security breach within 24 hours. Here is what the Act requires and how to be ready before it happens.
Security measures (Section 18). Controllers must implement technical and organisational measures to safeguard data against unauthorised access, accidental loss or alteration. The required level is “appropriate” to the risk.
Notify POTRAZ within 24 hours (Section 19). Notify the Authority of any security breach within 24 hours using Form DP3.
Notify data subjects in high-risk cases (Section 19). A 72-hour benchmark is best practice. Only the 24-hour Authority rule is strictly statutory.
In deciding whether your security is adequate, the Authority considers the current state of technological development, implementation costs, the sensitivity of the data and the specific risks to data subjects. Security is a scalable obligation, not a fixed checklist.
Under Section 18(5), a controller who subcontracts processing must have a written contract with the processor. The controller remains legally liable for making sure the processor maintains the same security measures the Act requires.
The 24-hour window is among the most demanding in the world and is designed to support national cyber-readiness. Failing to report within the window is a standalone statutory offence, whether or not the breach itself was preventable. See our guide to CDPA offences and penalties.
The following is practical guidance, not a statutory list:
Name who files. Decide in advance who completes and submits Form DP3, and who covers if they are unavailable.
Keep the form ready. Know where Form DP3 is and what information you will need to complete it.
Check processor contracts. Confirm each processor has a written contract and can alert you quickly.
Train your people. Staff cannot report a breach they do not recognise. Consider CDPA training for leadership and staff.
Within 24 hours, using Form DP3 (Section 19).
Section 19 requires notification of data subjects in high-risk cases. A 72-hour benchmark is best practice, but only the 24-hour rule for the Authority is strictly statutory.
Yes. Failure to report within the 24-hour window is a standalone statutory offence, regardless of whether the breach was preventable.
Yes. The controller is legally liable for ensuring the processor maintains the same stringent security measures, and must have a written contract with it.
How to Register as a Data Controller in Zimbabwe The five-step POTRAZ licensing process, Form DP1, required documents and renewal rules. Read the guide.
Data Protection Officer (DPO) in Zimbabwe What a DPO does, when you need one, Form DP2 and why independence matters. Read the guide.
Data Subject Rights Under the CDPA The five core rights, consent rules, children’s data and direct marketing. Read the guide.
CDPA Offences and Penalties in Zimbabwe Fines, imprisonment and personal liability under the Act and the Criminal Law Code. Read the guide.
PrivacyCure completes Form DP1, assembles the application pack, names a certified Data Protection Officer and keeps your filing aligned with the Act and its regulations. Email dpo@privacycure.com or use the contact page.
Information only, not legal advice. Statutory references follow the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024. Confirm current requirements with POTRAZ or a qualified adviser before you file or act.