The framework
Zimbabwe regulates personal data through the Data Protection Act 2021 (Cyber and Data Protection Act), supervised by the POTRAZ.
For advertisers the consent posture matters most, and Zimbabwe sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Data Protection Act 2021 (Cyber and Data Protection Act)
Zimbabwe's 2021 Act designates telecom regulator POTRAZ as DPA; 2024 regulations added DPO licensing, an unusual requirement worth flagging for local operations.
Marketing and advertising
Consent or listed bases; DPO licensing rules issued 2024. Most channel decisions here follow from that consent rule.
Cross-border transfers
Transfers abroad need an adequate destination or the authority's authorization.
Enforcement and penalties
The law provides for fines and criminal penalties. A ceiling means little until the authority uses it, so its docket is the better guide.