Cyber and Data Protection Act, 2021 Zimbabwe is the evaluation, guidance or treatment of persons of such sexual conduct, and who is recognised by a competent public body as being responsible for the welfare of such persons; (b) the objective of the processing of the data consist of the evaluation, guidance and treatment of the persons referred to in this section, and the processing of data relates only to the aforementioned persons: Provided that the competent public body referred to in paragraph (a) grants a specific, individualised authorisation, having received the opinion of the Authority. (7) 12. The authorisation referred to in this section shall specify the duration of the authorisation, the conditions for supervision of the authorised association or organisation by the competent public body, and the way in which the processing must be reported to the Authority. Genetic data, biometric sensitive data and health data (1) The processing of genetic data, biometric data and health data is prohibited unless, the data subject has given consent in writing to the processing. (2) The consent referred to in subsection (1) can be withdrawn by the data subject at any time without any reasons and free of charge. (3) The provisions of subsection (1) shall not apply where— (a) the processing is necessary to carry out the specific obligations and rights of the controller in the field of employment law; or (b) the processing is necessary to comply with national security laws; or (c) the processing is necessary for the promotion and protection of public health, including medical examination of the population; or (d) the processing is required by or by virtue of a law or any equivalent legislative act for reasons of substantial public interest; or (e) the processing is necessary to protect the vital interests of the data subject or another person, where the data subject is physically or legally incapable of giving his or her consent or is not represented by his or her legal, judicial or agreed representative; or (f) the processing is necessary for the prevention of imminent danger or the mitigation of a specific criminal offence; or (g) the processing relates to data which has apparently been made public by the data subject; or (h) the processing is necessary for the establishment, exercise or defense of legal rights; or (i) the processing is required for the purposes of scientific research; or (j) the processing is necessary for the purposes of preventive medicine or medical diagnosis, the provision of care or treatment for the data subject or to one of his or her relatives, or the management of health-care services in the interest of the data subject, and the data is processed under the supervision of a health professional. (4) Health-related data may only be processed under the responsibility of a health-care professional, except if the data subject has given his or her written consent or if the processing is necessary for the prevention of imminent danger or for the mitigation of a specific criminal offence. (5) The Authority shall be entitled to specify the conditions under which such processing may be carried out. (6) Health related data may only be collected from other sources where the data subject is incapable of providing the data. By Laws.Africa and contributors. Licensed under CC-BY. Share widely and freely. 7