Information. The right to know how and why data is used.
Data subjects · CDPA Sections 10, 11, 14 and 15
The Act makes individuals the owners of their information. Controllers need processes to honour these rights and to obtain valid consent.
Information. The right to know how and why data is used.
Access. The right to obtain a copy of held information.
Objection. The right to oppose processing, including an absolute right to object to direct marketing (Section 15), free of charge.
Correction. The right to rectify false or misleading information.
Deletion. The right to demand removal of inaccurate or unlawfully held data.
Section 10(2) allows implied consent for non-sensitive data among adults. Section 11 sets a higher bar for sensitive data, meaning genetic, biometric, health or racial-origin data, which requires explicit written consent.
Section 11(5) provides narrow exceptions where consent is not required, including compliance with employment-law obligations, protecting the vital interests of a subject who cannot consent, processing data the subject has made public, and national-security compliance or the defence of legal claims.
Under Sections 26 and 27, the rights of children (under 18) and of incapacitated persons are exercised by parents or legal guardians. Processing a child’s data is subject to the strictest oversight to prevent exploitation.
Because the right to object to direct marketing is absolute, any outreach that lacks a free, simple opt-out is unlawful. Moving to permission-based engagement reduces regulatory friction.
Your Data Protection Officer is the main contact point for access, correction and deletion requests. Read more in our DPO guide, or start with a CDPA assessment to see how ready your processes are.
Five core rights under Section 14: information, access, objection, correction and deletion.
For sensitive data such as genetic, biometric, health or racial-origin data (Section 11). Implied consent can suffice for non-sensitive data among adults (Section 10(2)).
Yes. The right to object to direct marketing is absolute and must be free of charge (Section 15).
Parents or legal guardians exercise the rights of children under 18 and of incapacitated persons (Sections 26 and 27).
How to Register as a Data Controller in Zimbabwe The five-step POTRAZ licensing process, Form DP1, required documents and renewal rules. Read the guide.
Data Protection Officer (DPO) in Zimbabwe What a DPO does, when you need one, Form DP2 and why independence matters. Read the guide.
Data Breach Notification in Zimbabwe The 24-hour rule, Form DP3, and what to prepare before a breach happens. Read the guide.
CDPA Offences and Penalties in Zimbabwe Fines, imprisonment and personal liability under the Act and the Criminal Law Code. Read the guide.
PrivacyCure completes Form DP1, assembles the application pack, names a certified Data Protection Officer and keeps your filing aligned with the Act and its regulations. Email dpo@privacycure.com or use the contact page.
Information only, not legal advice. Statutory references follow the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024. Confirm current requirements with POTRAZ or a qualified adviser before you file or act.