Cyber and Data Protection Act, 2021 Zimbabwe (7) For the purposes of processing personal information under this section, the health professional and his or her agents are subject to the duty of professional secrecy. (8) The processing of genetic data, shall be authorised if it is processed for what it reveals or contains and data concerning health shall be processed only if a unique patient identifier is given to the patient which is distinct from any other identification number, issued by the public authority established for this purpose. (9) The association of the unique patient identifier with any other identifier which permits the identification of the data subject as provided for in section 8 is permissible only with the express authorisation of the Authority. (10) The data of a child shall be processed subject to section 26. Part V – Duties of data controller and data processor 13. Duties of data controller Every data controller or data processor shall ensure that personal information is— (a) processed in accordance with the right to privacy of the data subject; (b) processed lawfully, fairly and in a transparent manner in relation to any data subject; (c) collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes; (d) adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed; (e) collected only where a valid explanation is provided whenever information relating to family or private affairs is required; (f) accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay; and kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected. 14. Rights of data subject A data subject has a right to— 15. (a) be informed of the use to which their personal information is to be put; (b) access their personal information in custody of data controller or data processor; (c) object to the processing of all or part of their personal information; (d) correction of false or misleading personal information; and; (e) deletion of false or misleading data about them. Disclosures when collecting data directly from data subject (1) When obtaining data directly from the data subject, the controller or the controller’s representative shall provide the data subject with at least the following information, unless the data subject has already received such information— (a) the name and address of the controller and of his or her representative, if any; (b) the purposes of the processing; By Laws.Africa and contributors. Licensed under CC-BY. Share widely and freely. 8