Can customers sue my business for misusing their data in Zimbabwe?
Short answer
Yes, in addition to POTRAZ action. The Cyber and Data Protection Act gives people enforceable rights and a complaint route to POTRAZ; separately, a person who suffers loss because you mishandled their information can pursue ordinary civil remedies, and employees increasingly raise data-handling failures in labour disputes.
What the law says
Section 14 gives every data subject rights of access, objection, correction and deletion, and section 6 gives POTRAZ the function of investigating complaints. The Act does not exclude the ordinary civil law: a person harmed by an unlawful disclosure can sue for breach of confidence, for defamation where false information is spread, or for damages caused by negligence in securing data. Unfair-labour-practice claims under the Labour Act can include an employer's misuse of employee information.
Example
A Harare clinic's receptionist tells a patient's employer about the patient's HIV status. The patient complains to POTRAZ (breach of the written-consent rule for health data under sections 11 and 12, and of security under section 18) and also sues the clinic for damages for the disclosure and its consequences for his employment. The clinic faces the regulator and the court at once, and its compliance file, which shows training and a confidentiality policy, is its main evidence in both.
In practice
Compliance evidence is your defence in both arenas: a privacy notice, consent records, training registers, access controls and a request log show that you took the duty seriously and that any failure was individual rather than systemic.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.