Cyber and Data Protection Act, 2021 22. 23. 24. Zimbabwe Authorisation (1) The Authority shall establish the categories of data processing which represent specific risks to the fundamental rights of the data subject and which require specific authorisation from the Authority. (2) Such authorisation shall only be provided following receipt of notification from the data controller or from the data protection officer pursuant to sections 15 and 16. Openness of processing (1) The Authority shall keep a register of all automatic processing operations of data. (2) Any entry in the register referred to in subsection (1) must include the information mentioned in section 16(1). (3) The register shall be available for inspection by members of the public, in the manner determined by the Authority. (4) In case of the processing of data exempted from notification by this Act, the Authority may, either by virtue of its office or at the data subject’s request, impose upon the controller the obligation to disclose to the data subject all or part of the information mentioned in section 16(1). Accountability The data controller shall— (a) take all the necessary measures to comply with the principles and obligations set out in this Act; and (b) have the necessary internal mechanisms in place for demonstrating such compliance to both the data subjects and the Authority in the exercise of its powers. Part VI – Data subject 25. 26. Decision taken on basis of Automatic Data Processing (1) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. (2) The right referred to in subsection (1) shall not be applicable if the decision based solely on automated processing is taken on the basis of the data subject having consented to such decision or is based on a provision established by law. Representation of data subject who is child Where the data subject is a child, his or her rights pursuant to this law may be exercised by his or her parents or legal guardian. 27. Representation of physically, mentally or legally incapacitated data subjects (1) A data subject who is physically, mentally or legally incapable of exercising the rights given under this Act and who is not subject to the provisions of section 26, may exercise such rights through a parent or guardian or as provided for by law or as designated by a Court of competent jurisdiction. (2) Incapacity as referred to in subsection (1) shall be proven by a physician or a person legally competent to do so. By Laws.Africa and contributors. Licensed under CC-BY. Share widely and freely. 12