Data protection for NGOs and private voluntary organisations in Zimbabwe

Being a non profit does not take you out of scope

This is the first thing to settle, because it is the most common misunderstanding in the sector. The licensing duty is not about profit.

Section 3(2)(d) of Statutory Instrument 155 of 2024 extends to a person who processes personal information to obtain a commercial gain "or other benefit". More directly, section 3(2)(a) to (c) and section 4(1) attach the duty to whoever decides the means, purpose and outcome of the processing, and what data is collected from whom. An organisation running a beneficiary registration exercise is doing exactly that.

The exemptions in section 8 are personal, family or household affairs, law enforcement, and journalistic, historical or archival purposes. There is no charitable, humanitarian or voluntary exemption, and the law enforcement and journalistic categories still have to register with the Authority even though they need not license.

What an NGO actually holds

Programme data is usually richer and more sensitive than commercial customer data, and it is usually held about people in a weaker bargaining position. Both facts raise the standard.

• Registration and targeting data. Names, national ID numbers, household composition, GPS coordinates of homesteads, vulnerability scoring and selection criteria.
• Health information. Nutrition status, HIV status, disability, maternal health and clinical referrals. Health data is sensitive under the Act.
• Child protection files. Case notes on children, which engage the children’s data regime in section 10(5) in full.
• Gender based violence case files. The highest risk category most NGOs hold, where a disclosure can put someone in physical danger rather than merely inconvenience them.
• Cash and voucher records. Mobile money numbers, transfer values, bank details and reconciliation lists shared with financial service providers.
• Monitoring and evaluation data. Survey responses, photographs, case studies and testimonies collected in the field, often on tablets, often synced to a platform hosted outside Zimbabwe.
• Staff, volunteer and partner records. Payroll, contracts, vetting records for staff working with children, and the contact lists of implementing partners.

Donor reporting is a cross border transfer

This is the obligation that catches the sector hardest, because it is built into the funding model. Section 10(2)(c) of Statutory Instrument 155 of 2024 requires a data controller to notify the Authority of any intention to transfer or share information of data subjects outside Zimbabwe. Note that the notifiable event is the intention, so it is something to do before the reporting cycle rather than after it.

Section 28 of the Cyber and Data Protection Act [Chapter 12:07] governs the transfer of personal information outside Zimbabwe, and section 29 deals with transfers to a country that does not assure an adequate level of protection. Contravening section 28 is one of the five sections named in section 33(2), carrying a fine of up to level 11 or imprisonment of up to seven years or both.

• Donor reports with beneficiary detail. A report containing named or re-identifiable beneficiaries is a transfer, whatever the file format.
• Cloud platforms hosted abroad. A survey platform, case management system or file store with servers outside Zimbabwe is a continuing transfer, not a one off event.
• Headquarters access. Where a regional or global office can log in and read Zimbabwean beneficiary records, the data is being shared outside Zimbabwe even if nothing is exported.
• Consortium partners. Sharing lists with an international partner requires the written arrangement in section 10(4)(f) as well as the cross border notification.

The practical fix is usually a combination of three things: notifying the intention properly, minimising what actually crosses the border by aggregating or pseudonymising before reporting, and papering the arrangement with the recipient. Most donors accept aggregated reporting once asked.

Consent when there is a power imbalance

Consent collected at a distribution point, from someone who believes that declining will cost them assistance, is fragile. The law does not describe it in those terms, but an inspector reviewing a consent process will look at whether the person had a real choice and whether they understood what they were agreeing to.

Where children are involved, section 10(5) requires the consent of the parent or legal guardian, requires reasonable efforts to verify that it came from the parent or guardian, and requires regular data protection impact assessments to identify and mitigate risks to children.

• Separate assistance from consent. The data needed to deliver the assistance should be distinguished from the data collected for reporting, case studies or fundraising, so that declining the second does not threaten the first.
• Consent in the right language. A notice a beneficiary cannot read is not a notice.
• Photography and stories as their own decision. Consent for a photograph or testimony used in fundraising should be specific, recorded and withdrawable, and should say where the image may appear.
• Verify guardianship. For children, record who gave consent and on what basis they were entitled to give it.

Which tier an NGO falls into

The count that sets your tier is data subjects, meaning people, not employees and not customers alone. It includes current and former staff, seasonal and casual workers, customers, enquirers who never bought, suppliers and their contact people, and anyone on a mailing list. Most organisations that assume they are small find they cross a tier boundary once the count is done properly, which is one of the things the consultation settles before anything is filed.

For an NGO the count is dominated by beneficiaries rather than staff. A programme that has reached tens of thousands of households over several years is counting all of those individuals, not just this year’s caseload, unless a retention schedule has been applied and followed.

Each legal entity licenses in its own registered name. Where an international organisation operates through a locally registered entity, it is that entity that appears on the licence.

Where NGOs most often come up short

• Beneficiary lists on personal devices. Spreadsheets of named beneficiaries on field officers’ laptops and phones, unencrypted, is the most common finding and the easiest to fix.
• Cross border transfers never notified. Years of donor reporting with no notification of the intention to transfer under section 10(2)(c).
• Photographs used in fundraising beyond the consent. An image consented for a programme report appearing in an international appeal years later.
• Partner sharing on nothing but an email. Section 10(4)(f) requires a written data processing agreement with each processor, and consortium data sharing usually has none.
• No retention schedule. Closed programmes whose beneficiary data is still held, which raises the tier and the risk without serving any purpose.
• GBV and child protection files with open access. Case files readable by the whole country office rather than the small group that needs them.

How StoneGuard gets it done

• Consultation. A $90 consultation opens the engagement. We work out what personal data you hold, which POTRAZ tier you fall into and what is missing. The fee is credited in full toward your package when you proceed.
• Gap analysis. A certified Data Protection Officer assesses your organisation against the Cyber and Data Protection Act on the StoneGuard platform and gives you a scored report with the gaps ranked.
• Licensing. We prepare and file your Data Controller licence application and your DPO appointment notification, and we handle the correspondence with POTRAZ until the licence is granted.
• Documentation. Your record of processing activities, privacy policy, consent wording, breach response procedure and data subject request procedure are drafted and put in place.
• Training. Staff training is delivered, which CDPG 1 of 2025 makes mandatory for licensed data controllers.
• Ongoing DPO. A certified Data Protection Officer stays on record for you after the licence is granted, keeps the registers current, handles data subject requests and breaches, files the annual renewal and attends POTRAZ inspections.

POTRAZ fees are paid to POTRAZ at cost, ex VAT, and are separate from the StoneGuard service fee. You will always see two numbers, never one blended figure.

Frequently asked questions

Get licensed and inspection ready

A $90 consultation opens the engagement and is credited in full toward your package when you proceed. Compliance packages start at $250. POTRAZ fees are separate and are paid to POTRAZ at cost, ex VAT.

Contact StoneGuard: email [email protected], WhatsApp +263 77 272 4514, or call +263 77 143 6742. StoneGuard is based in Harare, Zimbabwe.