Cyber and Data Protection Act, 2021 (6) (7) 21. Zimbabwe The Authority shall provide guidelines that provide for the qualifications and functions of data protection officer and such data protection officer’s duties shall include— (a) ensuring compliance by the data controller with the provisions of this Act and regulations made thereunder; (b) dealing with requests made to the data controller pursuant to this Act; (c) working with the Authority in relation to the performance of its functions in relation to the data controller. If exemption from the duty of notification has been granted for automatic processing in accordance with the subsection (3), the data controller may disclose the items of information mentioned in section 16 to any person entitled to receive such information. Content of notification (1) The notification referred to in section 20 shall state, at least— (a) the date of notification and the law or regulatory instrument permitting the automatic processing of data; (b) the surname, first names and complete address or the name and registered offices of the controller and of his or her representative, if any; (c) the denomination of the automatic processing; (d) the purpose or the set of related purposes of the automatic processing; (e) the categories of data being processed and a detailed description of the sensitive data being processed; (f) a description of the category or categories of the data subjects; (g) the safeguards that must be linked to the disclosure of the data to third parties; (h) the manner in which the data subjects are informed, the service providing for the exercise of the right to access and the measures taken to facilitate the exercise of that right; (i) the inter-related processing planned or any other form of linking with other processing; (j) the period of time after the expiration of which the data may no longer be stored, used or disclosed; (k) a general description containing a preliminary assessment of whether the security measures provided for pursuant to section 13 above are adequate; (l) the recourse to a data processor, if any; (m) the transfers of data to a third party as planned by the data controller. (2) The Authority may prescribe other information which shall be mentioned in the notification. (3) Where the Authority is of the opinion that the processing or transfer of data by a data controller entails specific risks to the privacy rights of data subjects, he or she may inspect and assess the security and organisational measures prior to the commencement of the processing or transfer. (4) The Authority may, during working hours, carry out further inspection and assessment of the security and organisational measures employed by a data controller subject to reasonable notification to the data controller of the Authority’s intended inspection and assessment. By Laws.Africa and contributors. Licensed under CC-BY. Share widely and freely. 11