Cyber and Data Protection Act, 2021 Zimbabwe Part VII – Transborder flow 28. 29. Transfer of personal information outside Zimbabwe (1) Subject to the provisions of this Act, a data controller may not transfer personal information about a data subject to a third party who is in a foreign country unless an adequate level of protection is ensured in the country of the recipient or within the recipient international organisation and the data is transferred solely to allow tasks covered by the competence of the controller to be carried out. (2) The adequacy of the level of protection afforded by the third party or international organisation in question shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; with particular consideration being given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the recipient third party or recipient international organisation, the laws relating to data protection in force in the third party or international organisation in question and the professional rules and security measures which are complied with in that third party or international organisation. (3) The Authority shall lay down the categories of processing operations for which and the circumstances in which the transfer of data to countries outside the Republic of Zimbabwe is not authorised. (4) The Minister responsible for the Cyber security and Monitoring Centre in consultation with the Minister, may give directions on how to implement this section with respect to transfer of personal information outside of Zimbabwe. Transfer to country outside Zimbabwe which does not assure adequate level of protection A transfer or a set of transfers of data to a country outside Zimbabwe which does not assure an adequate level of protection may take place in one of the following cases— (a) the data subject has unambiguously given his or her consent to the proposed transfer; (b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken in response to the data subject’s request; (c) the transfer is necessary for the conclusion or performance of a contract concluded or to be concluded between the controller and a third party in the interest of the data subject; (d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defense of legal claims; (e) the transfer is necessary in order to protect the vital interests of the data subject; (f) the transfer is made from a register which, according to acts or regulations, is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the case at hand. Part VIII – Code of Conduct 30. Code of Conduct (1) The Authority shall provide guidelines and approve codes of conduct and ethics governing the rules of conduct to be observed by data controllers and categories of data controllers. By Laws.Africa and contributors. Licensed under CC-BY. Share widely and freely. 13