Zimbabwe Cyber and Data Protection Notice

1. Purpose of this notice

This notice explains how personal information connected with applications, admissions, enrolment and student administration may be collected and processed when Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07] applies. It is intended to give applicants clear information before or at the time information is collected.

2. Relationship with South African POPIA

WBU-SA is based in South Africa and its POPIA Student Enrolment Privacy Notice remains the University’s primary enrolment privacy notice. This Zimbabwe notice supplements it for processing that falls within Zimbabwe’s territorial rules; it does not replace POPIA or reduce any protection available under another applicable law.

3. When Zimbabwe’s Act may apply

Section 4 of the Act covers relevant automated or partly automated access, processing and storage carried out in the context of a data controller’s effective and actual activities. It may also apply where a controller not permanently established in Zimbabwe uses processing means located in Zimbabwe, other than means used only for transit. An applicant’s Zimbabwean citizenship or residence, by itself, is not presented here as conclusive proof that the Act applies.

4. Institutional responsibility

Where the Act applies to a particular activity, WBU-SA will identify and fulfil the duties that apply to it as the person or institution determining the purpose and means of processing. The Office of the Registrar is the initial institutional privacy contact for enrolment matters. This contact role does not mean that the Registrar has been appointed as a statutory Data Protection Officer.

5. Personal information collected

1. Names, title, date of birth, age, gender, marital status and nationality where legitimately required.
2. Contact details, country of residence, address, telephone number and email address.
3. Identity, applicant, temporary admission and student reference information.
4. Educational history, qualifications, transcripts and programme choices.
5. Admission, enrolment, assessment, academic-progress and graduation records.
6. Employment, ministry or professional information where relevant to a programme or application.
7. Administrative-payment or transaction information where a lawful university fee applies.
8. Communications, supporting documents and information voluntarily supplied by the applicant.
9. Technical and security information generated when the website, enrolment form or LMS is used.

6. Information minimisation

In accordance with sections 7 and 13, WBU-SA will seek information that is adequate, relevant and not excessive for the stated enrolment purpose. Information should not be collected merely because it might be useful at an unspecified future time.

7. Sources of information

Information will ordinarily be collected directly from the applicant through the enrolment form, correspondence, interviews and documents submitted to the University. Information may also be received from authorised admissions personnel, referees, prior institutions, public records or verification services where lawful, necessary and properly disclosed.

8. Purposes of collection

1. To receive and evaluate applications.
2. To verify identity, qualifications and admission eligibility.
3. To communicate admission decisions and enrolment requirements.
4. To create and administer student, academic and LMS records.
5. To deliver teaching, assessment and student-support services.
6. To manage examinations, results, certification and graduation.
7. To maintain security, prevent fraud and investigate suspected misconduct.
8. To meet lawful reporting, governance, audit and accreditation-evidence requirements.
9. To comply with legal obligations and respond to authorised regulatory processes.

9. Specified and compatible purposes

Under section 9, collection must be for specified, explicit and legitimate purposes. WBU-SA will not intentionally use enrolment information for an incompatible purpose without a lawful basis and, where required, a fresh notice or consent.

10. Lawful grounds for processing

Depending on the circumstances, processing may be based on informed consent, steps requested before entering an educational relationship, performance of that relationship, a legal obligation, protection of vital interests, a task carried out in the public interest or legitimate interests that are not overridden by the data subject’s rights. WBU-SA will not present consent as the only lawful ground when the Act permits and the circumstances require another ground.

11. Consent

Where consent is relied upon, it must be specific, unequivocal, freely given and informed. Consent for sensitive information will be obtained in writing when section 11 requires it. Consent may be withdrawn, but withdrawal does not invalidate processing that was lawful before withdrawal and may affect services that genuinely require the information.

12. Mandatory and voluntary information

Applicants will be informed, where appropriate, which information is required and which is optional, together with the reasonably foreseeable consequences of not providing required information. WBU-SA will not describe optional information as compulsory.

13. Sensitive information

Sensitive information may include racial or ethnic origin, political or religious beliefs, trade or professional association membership, sex life, criminal, educational, financial or employment history, gender, age, marital or family status, health information, genetic information and other high-risk information recognised by the Act. Such information will be requested only when lawful, necessary and proportionate, with written consent or another applicable exception under section 11.

14. Information about children

The Act defines a child as a person under 18 years. Where a child’s information is processed, the child’s rights will be exercised by a parent or legal guardian as required by section 26, unless another applicable law provides otherwise. WBU-SA will seek appropriate guardian authority before using a child’s information for enrolment.

15. Notice at collection

When information is collected directly, WBU-SA will provide the information required by section 15 as applicable: the controller’s identity, the purpose, whether provision is compulsory or optional, consequences of non-provision, recipients or recipient categories, access and correction rights, and other information needed for fair processing. Where information is obtained indirectly, section 16 will be considered.

16. Accuracy and correction

Reasonable steps will be taken to keep information complete, accurate and up to date. Applicants and students should promptly notify the Registrar’s Office when their information changes. Proven inaccuracies will be corrected without unjustified delay.

17. Recipients and authorised access

Access will be limited to people who need the information for an authorised function. This may include the Registrar’s Office, authorised admissions personnel, academic and examination staff, student-support staff, approved IT or LMS providers, professional advisers, accreditation reviewers receiving properly controlled evidence, and public authorities where disclosure is legally required. Personal information will not be supplied to an accreditor merely because it asks for it; the disclosure must be relevant, proportionate and lawful.

18. Service providers and processors

Where a service provider processes information for WBU-SA, sections 17 and 18 require controlled access, appropriate safeguards and processing on the University’s instructions. WBU-SA will seek written contractual terms appropriate to the service, confidentiality, security, breach management, return or deletion of information and lawful sub-processing.

19. Cross-border processing

Enrolment information submitted from Zimbabwe may be received and administered in South Africa and may be stored through approved service providers in other countries. Where Zimbabwe’s Act applies, WBU-SA will assess sections 28 and 29 before transfer, including whether the destination provides adequate protection or whether consent, contractual necessity, public interest, legal claims, vital interests or another lawful condition supports the transfer.

20. Information security

WBU-SA will use reasonable technical and organisational safeguards proportionate to the nature, volume and risks of the information. Measures may include role-based access, password protection, secure transmission, backups, staff confidentiality, software maintenance, access review, incident response and controlled disposal. No internet system is completely risk-free, and applicants should avoid sending unnecessary sensitive documents through unapproved channels.

21. Security breaches

If a qualifying security breach occurs in processing covered by Zimbabwe’s Act, WBU-SA will investigate, contain and document it and will notify the Data Protection Authority within the period required by section 19, including the Act’s 24-hour requirement where applicable. Affected persons will also be informed when and within the period required by applicable law and regulations. This statement does not replace an incident-specific legal assessment.

22. Retention and disposal

Personal information will not be retained longer than necessary for the stated purpose, subject to academic-record, legal, contractual, dispute, audit and accreditation-evidence obligations. At the end of the applicable retention period, information will be securely deleted, anonymised or archived under controlled access where lawful preservation is required.

23. Rights of applicants and students

1. To receive clear information about processing.
2. To request access to personal information held about them.
3. To object to processing in appropriate circumstances.
4. To request correction of inaccurate or incomplete information.
5. To request deletion of false or misleading information and other deletion where legally available.
6. To withdraw consent where consent is the lawful ground.
7. To object to direct marketing without charge.
8. To raise a complaint with WBU-SA and, where the Act applies, with Zimbabwe’s Data Protection Authority.

24. Automated decisions

WBU-SA will not intentionally subject an applicant to a decision based solely on automated processing that produces legal or similarly significant effects, except where section 25 or another applicable law permits it and the required safeguards are in place. Admission decisions will ordinarily include appropriate human oversight.

25. Direct marketing

Enrolment details will not automatically be treated as consent to unrelated marketing. Any direct marketing will be conducted only on a lawful basis, and recipients will be given a free and practical way to object or unsubscribe.

26. Regulatory status and accountability

WBU-SA will assess whether any Zimbabwean controller licence, notification, local representative, Data Protection Officer or other regulatory step is legally required for its actual processing activities. Nothing on this page should be read as claiming that such a step has already been completed. The University will keep appropriate privacy records and update the public wording if its formal status changes.

27. Privacy enquiries and complaints

Questions, access or correction requests, objections and complaints concerning enrolment information should first be sent to the WBU-SA Office of the Registrar through the University’s official Contact Us page. If the matter is governed by Zimbabwe’s Act, the person may also contact the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which is designated as the Data Protection Authority under section 5.

28. Legal and governance references

• Cyber and Data Protection Act [Chapter 12:07], Act No. 5 of 2021, particularly sections 4, 7–11, 13–21 and 24–29.
• Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024), where applicable.
• Protection of Personal Information Act 4 of 2013 (South Africa), as addressed in WBU-SA’s separate POPIA Student Enrolment Privacy Notice.
• WBU-SA’s internal admissions, student-record, information-security and retention procedures.

29. Review and limitation

This notice will be reviewed at least annually and when relevant law, systems or processing practices change. It is a public transparency statement and compliance aid; it is not a regulatory licence, legal opinion, accreditation certificate or guarantee that every law applies to every applicant or activity. Where necessary, WBU-SA will obtain professional legal or regulatory advice.