Zimbabwe's Cyber and Data Protection Act, 2021 does two jobs. It sets up a privacy regime, and it carries criminal offences for online speech. A new report on digital public infrastructure across Africa makes it a good moment to ask whether the first job can work while the second remains.
The news hook, and what is not yet verified
CIPESA, the Collaboration on International ICT Policy for East and Southern Africa, announced that its 2026 State of Internet Freedom in Africa report would launch alongside the FIFAfrica26 forum, held in Mauritius from 28 September to 1 October 2026. The report is listed as covering AI, platform accountability and digital public infrastructure, meaning digital ID, biometric registration and related systems, across 11 countries including Zimbabwe. We could not load the report. CIPESA's site returned a 503 error when we tried, so this article does not describe its Zimbabwe findings. What we can examine is the Zimbabwean legal framework that any such findings will be set against.
That framework has recently moved. Press reports say the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which the Act designates as the Data Protection Authority, began mandatory inspections of data controllers on 1 September 2026 under Regulatory Notice 2 of 2026. We could not retrieve the notice itself, so the date rests on local press coverage.
The strongest case for the regime
The case for POTRAZ's approach is real. Data protection law that is never enforced protects no one. Zimbabwe's licensing rules are Statutory Instrument 155 of 2024, which MISA Zimbabwe summarises as requiring any entity handling the personal data of 50 or more individuals to hold a POTRAZ licence and appoint a data protection officer. MISA also says journalistic, law-enforcement and household processing is exempt. A regulator that audits hospitals, schools, banks and telecoms for how they store citizens' records is doing what regulators in Nairobi, Lagos or Brussels also do. Africa's rapidly growing digital ID and mobile-money systems hold large pools of sensitive data, and breaches there harm ordinary people. Inspections are a proportionate answer to that risk, and we support them.
Where the design goes wrong
The problem is that the same Act is also used against speech. POTRAZ stated in January 2026 that Zimbabwe has no standalone cybercrimes law. It said the Act made consequential amendments to sections 163 to 168 of the Criminal Law (Codification and Reform) Act, and that offences include cyber-bullying and harassment and the transmission of false data messages intended to cause harm. It said penalties range up to 10 years in prison.
These offences have been used in practice:
- In February 2025, journalist Blessed Mhlanga was detained after he broadcast speeches by Blessed Geza. Techzim reported that the specific charge under the Act was transmitting a data message inciting violence or damage to property, which it quotes as carrying a fine or up to five years in prison. Techzim also described the charges as two counts under section 164 of the Criminal Law Act, and the two descriptions are not reconciled in the article.
- In March 2026, a 25-year-old Harare woman was brought before a magistrate over a TikTok video allegedly insulting a businesswoman. She was charged with cyber-bullying and harassment under section 164B of the Act, according to New Zimbabwe via allAfrica.
The second case may be an ordinary harassment dispute, and nothing here suggests prosecutors acted in bad faith. But vague, speech-based offences are a poor fit for a statute whose purpose is privacy. Terms like "false data message" or "harm" let authorities decide after the fact which speech counts. Criminal exposure also chills speech well before anyone is charged.
Why digital public infrastructure raises the stakes
Surveillance risk comes from the pairing of infrastructure and discretion. A biometric ID system, a SIM registration database and a social media monitoring capability are each manageable on their own. Together, with a regulator that both audits private firms and sits close to the state, they make it easy to link an identity to a post. The exemption for law-enforcement processing, which MISA says the licensing rules contain, means the state's own data handling falls outside the audit regime applied to private firms. We have not seen evidence that Zimbabwe is running such a linkage. The point is that the legal safeguards that would stop it are thin.
The United States offers a cautionary comparison, because it shows that having rule-of-law institutions does not prevent monitoring. On 3 November 2026 the Electronic Frontier Foundation reported that records obtained through Freedom of Information Act litigation show the US Postal Service's internet Covert Operations Program monitored social media posts about protests across the political spectrum in 2020 and 2021. EFF says the agency claims it has since stopped issuing bulletins. Oversight rules were minimal, and the emails were deleted under a retention schedule. If that can happen where courts and a free press operate, the risk is higher where they are weaker.
What proportionate reform would look like
Keep the inspections. Change the surrounding law:
- Narrow the speech offences. Repeal or tightly define "false data message" and cyber-bullying provisions, and require proof of specific, serious and imminent harm.
- Separate the regulator from policing. POTRAZ should publish inspection results and enforcement data, and should not take part in speech investigations.
- Bring state processing inside the audit regime. Law-enforcement and ID databases should face the same inspection, purpose-limitation and breach-notice duties as private firms, with judicial authorisation for access.
- Require impact assessments before any new biometric or ID system launches.
The open internet and a growing digital economy both depend on trust that personal data will not be turned against its owner. Zimbabwe can build that trust by regulating the data handler, whether private or public, without prosecuting the speaker.