Cyber and Data Protection Act, rights of the data subject

Cyber and Data Protection Act, No. 5 of 2021, ss. 14-16, 25-26 (rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 11 March 2022.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Give a data subject notice of who is responsible for processing and why, and let them access, object to, correct, or have deleted false or misleading personal data about them.
Make the disclosures section 15 requires when you collect personal information directly from the data subject.
Do not take a decision about a data subject on the basis of automatic data processing outside what section 25 allows, and deal with a child data subject through the representation section 26 provides.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 14 gives a data subject the right to be informed of the use to which their personal information is to be put, to access the personal information a data controller or data processor holds about them, to object to the processing of all or part of it, to have false or misleading personal information corrected, and to have false or misleading data about them deleted.

Sections 15 and 16 fix the disclosures owed when data is collected directly from the data subject and the information the controller must hold. Section 25 governs a decision taken on the basis of automatic data processing, and section 26 the representation of a data subject who is a child. The Act was gazetted on 11 March 2022, the day it came into operation, so these provisions have bound since then.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
serves_minors

Read the law

Cyber and Data Protection Act
No. 5 of 2021, official text as gazetted with the correct title and chapter number on 11 March 2022, reproduced by Veritas Zimbabwe

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app