Cyber and Data Protection Act, 2021 Zimbabwe "data controller" or "controller"— (a) refers to any natural person or legal person who is licensable by the Authority; (b) includes public bodies and any other person who determines the purpose and means of processing data; "data controller’s representative" or "controller’s representative" refers to any natural person or legal person who performs the functions of the data controller in compliance with obligations set forth in this Act; "Data processor" refers to a natural person or legal person, who processes data for and on behalf of the controller and under the controller’s instruction, except for the persons who, under the direct employment or similar authority of the controller, are authorised to process the data; "Data Protection Authority" or "Authority" refers to Postal and Telecommunications Regulatory Authority of Zimbabwe established in terms of section 5 of the Postal and Telecommunications Act [Chapter 12:05]; "data protection officer" or "DPO" refers to any individual appointed by the data controller and is charged with ensuring, in an independent manner, compliance with the obligations provided for in this Act; "data subject" refers to an individual who is an identifiable person and the subject of data; "disproportionate effort" means effort that is so labour intensive as to consume a lot of time, money and manpower resources; "electronic communications network" means any electronic communication infrastructure and facilities used for the conveyance of data; "genetic data" refers to any personal information stemming from a Deoxyribonucleic acid (DNA) analysis; "health professional" refers to any individual determined as such by Zimbabwean law; "identifiable person" means a person who can be identified directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity; "Minister" means the Minister responsible for information and communications technologies; "personal information" means information relating to a data subject, and includes— (a) the person’s name, address or telephone number; (b) the person’s race, national or ethnic origin, colour, religious or political beliefs or associations; (c) the person’s age, sex, sexual orientation, marital status or family status; (d) an identifying number, symbol or other particulars assigned to that person; (e) fingerprints, blood type or inheritable characteristics; (f) information about a person’s health care history, including a physical or mental disability; (g) information about educational, financial, criminal or employment history; (h) opinions expressed about an identifiable person; (i) the individual’s personal views or opinions, except if they are about someone else; and (j) personal correspondence pertaining to home and family life; By Laws.Africa and contributors. Licensed under CC-BY. Share widely and freely. 2