Cyber and Data Protection Act: implications for journalists, human rights defenders, and NGOs (Part 1)

Although its objective of enhancing cybersecurity is commendable, the Act's broad and vague wording, along with its regulations, raises concerns. Its scope is extensive, applying to any organization that processes or stores data electronically, making compliance particularly onerous for those handling personal information. The Act's provisions and new computer crimes could potentially restrict freedoms of expression and association, especially for journalists, human rights defenders, and non-governmental organizations NGOs.

The Postal and Telecommunications Regulatory Authority of Zimbabwe Potraz is designated as the data protection authority, with wide-ranging powers to regulate data processing, conduct investigations, and compel disclosure of documents. Potraz can also mandate licensing for all entities processing digital personal information and inspect security measures if privacy risks are perceived. While Potraz issues guidelines to clarify the legislation, these do not have the force of law and are not always accurate.

The requirement for all organizations, including small clubs and NGOs, to obtain a data controller's license and appoint a qualified data protection officer presents significant financial and logistical burdens. The Act's strict rules on processing "sensitive data," which includes personal d