Cyber and Data Protection Act, 2021 (2) Zimbabwe Subject to this Act, the Authority shall not, in the lawful exercise of its functions under this Act, be subject to the direction or control of any person or authority. Part III – Quality of data 7. Quality of data (1) The data controller shall ensure that data processed is— (a) adequate, relevant and not excessive in relation to the purposes for which it is collected or further processed; (b) accurate and, where necessary, kept up-to-date; (c) retained in a form that allows for the identification of data subjects, for no longer than necessary with a view to the purposes for which the data is collected or further processed. (2) The data controller shall take all appropriate measures to ensure that data processed shall be accessible regardless of the technology used and ensure that the evolution of technology shall not be an obstacle to the access or processing of such data. (3) The controller shall ensure compliance with the obligations set out in subsections (1) and (2) by any person working under his or her authority and any subcontractor. Part IV – General rules on the processing of data 8. Generality The data controller shall ensure that the processing of data is necessary and that the data is processed fairly and lawfully. 9. 10. Purpose (1) The data controller shall ensure that data is collected for specified, explicit and legitimate purposes and, taking into account all relevant factors, especially the reasonable expectations of the data subject and the applicable legal and regulatory provisions, that the data is not further processed in a way incompatible with such purposes. (2) Under the conditions established by the Authority, further processing of data for historical, statistical or scientific research purposes is not considered incompatible. Non-sensitive data (1) Personal information may only be processed if the data subject or a competent person, where the data subject is a child, consents to the processing of such data. (2) The consent referred to in subsection (1) may be implied where the data subject is an adult natural person or has a legal persona and has full legal capacity to consent. (3) The processing of non-sensitive data is permitted, without the consent of the data subject, where necessary for purposes of— (a) being material as evidence in proving an offence; or (b) compliance with an obligation to which the controller is subject by or by virtue of a law; or (c) protecting the vital interests of the data subject; or By Laws.Africa and contributors. Licensed under CC-BY. Share widely and freely. 5