When African digital-rights groups met at the 13th Forum on Internet Freedom in Africa (FIFAfrica26) in Mauritius from 28 September to 1 October 2026, the agenda covered data governance, platform accountability and digital security. Zimbabwe was not the subject of a dedicated event, but its recent record is exactly the kind of case such forums exist to examine: a cyber law already used against a reporter, and a telecoms bill that could widen the state's reach into private communications.
The case for the state's position
Governments have a legitimate interest here. Online defamation, fraud and incitement cause real harm, and a regulator needs powers to investigate them. Zimbabwe's Cyber and Data Protection Act, passed in 2021, also created a data protection framework, with POTRAZ named as the data protection authority. The regulator announced inspections from 1 September 2026 to check that organisations obliged to hold data controller licences have them and have appointed data protection officers, starting with financial institutions and insurers. That is ordinary compliance work, and a country with no data protection regime is worse off for its citizens than one with a clumsy one.
Surveillance and interception powers are likewise a standard feature of modern states. The question is never whether they exist, but who authorises them and who checks the authoriser.
What the Mupurwa case shows
On 4 February 2026, Zimbo Live journalist Pellagia Mupurwa was arrested in Harare after publishing interviews with Budiriro residents who accused businessman Steven Mutumhe of forcibly acquiring a man's property. According to the International Press Institute, the charge fell under Section 164(C) of the Criminal Law (Codification and Reform) Act, as amended by the 2021 Cyber and Data Protection Act. It covers transmitting false messages intended to cause harm and carries a fine, up to five years' imprisonment, or both. The charges were withdrawn on 6 February after Mutumhe withdrew his complaint, but not before Mupurwa suffered a medical emergency in detention and was hospitalised.
The outcome was a private settlement, not a judicial test of the law. That matters. The offence survived the case intact, and the next complainant can invoke it again. The Zimbabwe Union of Journalists argued that reputational disputes "belong in civil courts, not police cells", and IPI contends that the provision effectively revives criminal defamation. Zimbabwe's Constitutional Court held on 12 June 2014 in Madanhire v Attorney General (CCZ 2/14) that criminal defamation was "unnecessary, disproportionate, and therefore excessive", as summarised by Columbia's Global Freedom of Expression project. A "false message" offence that turns on a complainant's displeasure with a story reproduces the same problem under a different label.
The pattern is not isolated. IPI notes that journalist Blessed Mhlanga was charged under the same provisions in February 2025, with his trial due to resume in February 2026.
Why the telecoms bill raises the stakes
MISA Zimbabwe's July 2026 analysis of the Postal and Telecommunications Amendment Bill identifies the surveillance risk. Section 93L, it says, "permits private companies and their employees to detain communications on mere suspicion", with authorisation coming only afterwards. MISA calls this "vulnerable to abuse, particularly against journalists, activists, and political opponents", and argues that privacy intrusions must be "lawful, necessary, and proportionate, with independent oversight." It also warns that ministerial control over board appointments and policy directions may affect regulatory independence, and that broad security definitions "could be used to justify network shutdowns or content blocking."
The existing baseline is not reassuring. The Global Network Initiative's country assessment of Zimbabwe, as summarised in search results, describes the Interception of Communications Act as lacking judicial oversight at the warrant stage; that page could not be re-verified for this article, so we treat it as a lead, not a finding.
A proportionate alternative
The pro-innovation argument is practical. Surveillance risk is a cost on the whole digital economy: founders, fintech operators and platforms build where users and staff can communicate without fear that a suspicion-based detention power or a vague false-message offence applies to them. Proportionate reform would be inexpensive:
- Prior judicial authorisation for interception and for any detention of communications, with after-the-fact approval reserved for narrowly defined emergencies.
- Narrow the false-message offence by requiring proof of concrete, serious harm and leaving reputational disputes to civil courts, consistent with the 2014 reasoning.
- Separate regulator from policy-maker, so ministerial directions cannot be used to steer enforcement.
- Clear definitions of network security that exclude shutdowns and blanket content blocking as remedies.
- Transparency reporting on interception requests, which costs little and lets Parliament and the public test whether powers are used proportionately.
None of this disarms the state against fraud or incitement. It routes those powers through a court, which is where legitimate cases tend to survive scrutiny.
What to watch
Forums like FIFAfrica matter less for their declarations than for the comparative evidence they circulate: which African jurisdictions have narrowed their cyber-offences, which have added judicial gatekeeping, and what happened to investment and press freedom afterwards. Zimbabwe's Parliament has an opportunity to draw on that record while the amendment bill is still being debated. If it adopts Section 93L as drafted, the Mupurwa case will not be an outlier but a preview.