For years, data protection sat with the IT department. That is changing. The Cyber and Data Protection Act sets out how organisations must collect, use and protect personal information, and the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) acts as the data protection authority.
Regulations on the licensing of data controllers and the appointment of data protection officers have made compliance a concrete, board-level task.
What boards should ask
- Do we know what personal data we hold, where, and why?
- Are we licensed as a data controller where required?
- Have we appointed a qualified data protection officer?
- Can we respond to a breach, and to a customer asking to see their data?
The Leader Intelligence Briefings for Executive Teams
Learn about corporate briefings“The question is no longer whether we have a privacy policy. It is whether the board can show how data is governed.”
— A data protection officer at a Harare financial institution
For banks, insurers, telecoms and retailers, which handle large volumes of customer data, the obligations are significant. But they apply to any organisation processing personal information, including schools, clinics and small businesses.
Key terms
- Data controller: the organisation that decides why and how personal data is processed.
- Data protection officer (DPO): the person responsible for overseeing compliance.
- Data subject: the individual the data is about.
Where this leads
Executive analysis for decision-makers and capital allocators.
- Opportunity
- Growing demand for data protection officers, privacy consultants and compliance technology.
- Risk
- Regulatory penalties and reputational damage after a breach.
- What to watch
- Guidance and enforcement activity from the data protection authority.
