Zimbabwe’s data rules: what AI leaders need to check before deployment

An AI project can create a data-protection issue long before it reaches production. A staff member may paste a customer record into a public tool. A software vendor may process employee information outside Zimbabwe. A pilot may combine datasets that were never collected with that use in mind.

For leadership teams, the first governance question is therefore not simply, “Can this AI tool do the job?” It is, “What information will it use, who will control it and where will it go?”

This is becoming a more consequential question across the continent. Digital Policy Alert reported that, by the end of 2025, 44 African countries had enacted data-protection laws and 38 had fully operational data-protection authorities. Those figures describe broad regulatory coverage; they do not mean every country has identical rules or enforcement practices.

What Zimbabwe requires

Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07] and the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024, known as SI 155 of 2024, create obligations that organisations should assess before processing personal information through AI. POTRAZ acts as the Data Protection Authority.

The regulations provide for data-controller licensing, with licences valid for 12 months and renewal applications due at least three months before expiry. They also set out data-protection-officer requirements for licensed controllers. An organisation should establish whether it is acting as a controller, a processor or both in a particular arrangement, and confirm which licensing, registration, appointment or exception provisions apply to it.

“Anyone using personal data needs a licence” is too blunt a summary of the rules.

Incident readiness matters just as much as paperwork. Under the regulations, a controller must notify the authority of a personal-data breach within 24 hours of becoming aware of it. Where the breach is likely to pose a high risk to affected people, a separate notification to those people is required within 72 hours. An organisation cannot meet those deadlines if nobody knows which team owns the response or if a vendor waits too long to disclose an incident.

Cross-border does not mean prohibited

A common mistake is to treat “data sovereignty” as a simple rule that all data must stay in Zimbabwe. The more useful question is whether an international transfer is permitted and properly governed.

Zimbabwe’s Act places conditions on transfers of personal information to recipients in other countries, including protections for the data and applicable exceptions. Legal guidance also identifies notification requirements relating to intended transfers. A cloud or AI service using overseas infrastructure therefore calls for a documented assessment; its foreign location does not, by itself, establish that use of the service is unlawful.

Zimbabwe’s 2026–2030 National AI Strategy reinforces the policy direction by identifying data protection and secure data-sharing ambitions. A strategy commitment, however, should not be confused with a new operational exemption from the existing law.

A practical pre-deployment check

1. 01What personal information enters the workflow? Include prompts, uploaded files, connected databases, outputs and logs.
2. 02Who determines how it is used? Identify the controller, processors and relevant vendors for each data flow, then confirm the organisation’s licensing or registration position.
3. 03Where can the information go? Map hosting locations, vendor access, subprocessors and any international transfers; document the applicable transfer assessment and notifications.
4. 04What may staff enter into public AI tools? Set an explicit rule for customer, employee, confidential and sensitive information.
5. 05How quickly will the vendor tell us about an incident? Contractual notification and escalation arrangements must give the organisation a realistic chance of meeting its own obligations.
6. 06Can we respond on the clock? Rehearse a suspected personal-data breach, including the point at which the organisation became aware of it, the decision on notification and the evidence that must be retained.

This is not an argument against using cloud services or AI. It is an argument for understanding the data flow before a tool becomes embedded in everyday operations.

This article provides general information, not legal advice. Requirements should be checked against the current law and the facts of each deployment.