If you operate in Mining enterprises, the Cyber and Data Protection Act [Chapter 12:07] almost certainly applies to you. The Act covers any organisation that determines the purposes and means of processing personal data — in the Act's language, a "data controller". Employee biometrics, medical surveillance data and contractor records across multiple sites. That alone places you within scope, because the Act regulates the handling of personal data wherever it is collected, stored or shared.
Personal data means any information relating to an identified or identifiable natural person. For Mining enterprises, that typically includes employee biometrics, medical surveillance data and contractor records across multiple sites, together with identity details, contact information and any material that could identify an individual directly or indirectly. Some of what you hold may be "special personal information" — health data, biometric data, or data about children — which the Act protects more strictly and which can only be processed on narrower lawful bases.
Your core obligation is to register and licence as a data controller with POTRAZ, the Postal and Telecommunications Regulatory Authority of Zimbabwe. Licensing is not optional and not limited to large organisations; it follows from the fact of processing, not the size of the business. You are also required to appoint a Data Protection Officer (DPO) and to record that appointment in writing. Informal delegation to an existing staff member, with nothing on paper, does not satisfy the Act.
Mining enterprises was named among the sectors POTRAZ signalled it would assess first under its risk-based inspection programme, which begins on 1 September 2026. Being in this first group means the regulator has already formed a view that your processing carries elevated risk, and you should expect earlier attention rather than later.
The practical starting point is a processing register: a living record of what personal data you hold, why you hold it, where it lives, who can reach it, and where it goes next. From there, the six-step readiness checklist — confirm controller status, map what you hold, appoint a DPO in writing, register and licence with POTRAZ, issue privacy notices and tighten access, then train your team and keep evidence — gives you a defensible position when inspectors arrive. Non-compliance carries liability on conviction; the cost of preparation is a fraction of the cost of being found unready.