Is the Data Protection Act Meant to Protect Citizens, or Censor Freedom of Expression?

Story By Staff Reporter

Zimbabwe’s Cyber and Data Protection Act was meant to make the internet safer. Panelists at a recent media policy dialogue now say it is being used to silence journalists. The discussion was organised by the Media Alliance of Zimbabwe (MAZ) and the International Media Support, and it asked a pointed question. Is the law a shield for citizens, or a sword for the powerful?

A Noble Law With Grey Areas

Parliament introduced the Act about two years ago to tackle cybercrime. Lawmakers wanted to curb cyberbullying and the misuse of online platforms. The law also aimed to protect children and women in online spaces.

MAZ coordinator Nigel opened the session by acknowledging those good intentions. However, he said the law has since been turned against the people it was meant to protect. Four journalists have reportedly been arrested this year on cyberbullying charges over stories they wrote. According to Nigel, those stories offended the ruling elite.

Highfield legislator Donald Mavudzi, who sits on the Portfolio Committee on Information Communication Technologies, agreed. He explained that the committee considers the Act its own “baby”. Even so, he admitted that the law targets well-meaning individuals, particularly journalists. He called the problem “a cancer” that the committee and the country must address.

Vague Wording Creates a Chilling Effect

Tech development consultant Chido, from the Nuance Collective, said vague wording is the biggest problem. Rules against “false messages” and cyber harassment are so broad that almost anything can fall under them. As a result, reporters who expose corruption can be accused of causing harm or of being unpatriotic.

She also noted that the trend extends beyond Zimbabwe. Similar laws have been used to control online conversations in Tanzania and Zambia. In Tanzania, for example, the platform Jamii Africa has seen its leader arrested several times under such legislation.

Nigel added that the region offers other warnings. Tanzania requires people with more than 10,000 followers to register or obtain a licence. Zimbabwe has not gone that far. Nevertheless, a loophole exists, because the Broadcasting Services Act defines “webcasting” in a way that could cover some online content creators.

Surveillance Puts Sources at Risk

Chido also raised concerns about privacy. Mandatory SIM registration and biometric data collection make it harder for whistleblowers to come forward. Citizens fear that their messages can be traced back to them.

Whistleblowing is vital to the media’s watchdog role. Journalists must therefore use complex encryption tools and offline methods to protect their sources. These steps slow down daily reporting. Furthermore, many available tools are designed in the West and are not easy for local newsrooms to use.

Compliance Costs Hurt Small Newsrooms

Cost is another burden. Small outlets operate on tight budgets, yet complying with the law is expensive. Registering as a data protection officer is particularly cumbersome. Independent officers feel the pinch most, while corporate-sponsored ones are largely unaffected.

Mavudzi said the committee raised the issue with the regulator, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ). The regulator committed to looking into it. The committee also took part in an October 2025 workshop with POTRAZ to align the 2024 data protection guidelines with the Act. In addition, it is pushing a parliamentary motion for an open data policy.

A Regulator With a Conflict of Interest?

Chido questioned POTRAZ’s independence. The authority regulates telecoms operators and also trains data protection officers. Meanwhile, operators handle user data and carry out state surveillance requests. In her view, one body cannot protect privacy objectively while serving all of these roles.

Her proposed fix has two parts:

• Ratify the Malabo Convention, which requires data protection bodies to be independent of telecoms regulators and security agencies.
• Create an autonomous privacy commissioner within an existing human rights framework.

Mavudzi confirmed that the Malabo Convention is still “in the pipeline”. The minister told Parliament that it will come for ratification, but no date has been given.

Learning From Other Models

Asked for examples to follow, Chido pointed to the European Union as the gold standard. Websites there must tell users what data they collect. Users can then accept, restrict or reject that collection. Still, she cautioned against copying any model wholesale. Zimbabwe’s context and institutions differ, so any framework must be adapted to local realities.

Trust Is the Missing Ingredient

Participants stressed that trust and accountability remain the core issues. One speaker said Zimbabwe has good policies, but citizens suspect that data protection is really about surveillance. Others shared worrying experiences. People receive threatening messages from strangers and cannot find out how those strangers got their phone numbers.

Chido urged transparent community oversight of surveillance systems. Traffic cameras in towns are a good example. Citizens should know where the footage goes and whether it is used for anything else. She also asked who actually owns the data.

Calls for Journalist Protection

An audience member called for professional indemnity cover for journalists. Many have been arrested for “transmitting falsehoods”, even when their work was researched and fact-checked. The speaker cited a Techno Mag reporter who was arrested in Budiriro after exposing a land baron. The speaker asked how the law distinguishes fake news from credible journalism.

Mavudzi agreed and promised to take the proposal to his committee.

The Way Forward

Nigel closed by summarising the panel’s recommendations. The Act needs reform to guarantee the independence of the data protection authority. The law also needs clearer wording, possibly through a statutory instrument, because vagueness invites abuse. Finally, he called for a media literacy policy so that journalists and citizens do not break the law unknowingly.

The debate shows that Zimbabwe’s challenge is not whether to regulate the internet. Rather, it is how to protect citizens without silencing the voices that hold power to account.