Using AI under Zimbabwe's Cyber and Data Protection Act: what businesses should know
Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] applies to any business that collects personal data, which includes most AI systems: a WhatsApp agent reads customer messages, CCTV analytics sees people, payroll holds employee records, and facial recognition uses biometric data. The Act does not stop you using AI. It requires you to know what data you hold, why, who can see it and how long you keep it. This is general information, not legal advice.
Who is responsible
The business that decides why and how data is used is the controller, and carries the main responsibility. A supplier that builds or runs the system on its behalf is a processor and must follow the controller's instructions. Your contract with a supplier should say so.
Know your data
List what each system collects, why, where it is stored, who can access it, and how long it is kept. If you cannot answer those questions for a system, fix that before switching it on.
Sensitive data needs more care
Biometric data, such as facial templates, and other sensitive categories need stronger justification, clear notice and tighter controls. Facial recognition should be a deliberate choice with the data protection steps in place first, not a default setting.
Tell people
Customers talking to an AI agent should know it is automated. Staff and visitors should be told about cameras and what they are used for. Signage and privacy notices are part of the system.
POTRAZ and professional advice
POTRAZ is the Data Protection Authority under the Act. Licensing, registration and other obligations may apply to your business. Take advice from a lawyer on what applies to you.
Questions buyers ask
Does the Act ban facial recognition?
It treats biometric data as sensitive and sets stricter conditions. Take legal advice before using it.
Can our data be stored outside Zimbabwe?
The Act restricts transfers outside Zimbabwe. Check where any system stores data and take advice on what is permitted.
Who is liable if a supplier gets it wrong?
Responsibility is shared according to roles under the Act and your contract. Make sure the contract is clear.
Book a platform briefing
A 15-minute technical discussion with an engineer in Harare. Tell us how the work runs today and we will say plainly what could be automated. Email sales@eigenstatesystems.com or message us on WhatsApp at +263 77 636 6999.