Potraz dismisses claims Zimbabwe has enacted a cyber crimes act: All you need to know
Social media has been flooded with reports that Zimbabwe has enacted a new cyber law to deal with the Cyber crime but POTRAZ has moved to dismiss those reports. The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) has moved to correct misinformation circulating online. Zimbabwe has not passed a separate law called a “Cyber Crimes Act.” Instead, cybercrime offences are handled through amendments to the Criminal Law (Codification and Reform) Act changes introduced when the Cyber and Data Protection Act (2021) updated the Criminal Code. So actually what is the cybercrime act and how does it affect general citizens.
POTRAZ, which is the country’s designated Data Protection Authority described social media reports claiming a standalone “Cyber Crimes Act” had been enacted as “false and misleading.” The regulator reminded the public that the criminal law already contains cyber-related offences after the 2021 amendments.
The legal reality
• Zimbabwe does not currently have a separate statute titled “Cyber Crimes Act.” Instead, cybercrime offences are embedded in the Criminal Law (Codific [Chapter 9:23], as amended by the Cyber and Data Protection Act, 2021 (Chapter 12:07).
• The 2021 Act made consequential amendments to the Criminal Code (notably sections that the legislature revised to cover computer systems, data and electronic communications) to create cyber-related offences.
What kinds of conduct are criminalised now
The amended Criminal Code and the Cyber and Data Protection Act cover a broad range of cyber-related offences, including (but not limited to):
• Hacking and unlawful interference with computer systems or data;
• Unlawful acquisition, disclosure or misuse of data, passwords or PINs;
• Using devices or tools meant to commit cyber offences;
• Transmission of threatening or incitatory messages; cyberbullying, harassment and sending false data messages intended to harm;
• Spam and unsolicited messages; transmission of intimate images without consent and recording intimate body parts without consent;
• Production/dissemination of racist or xenophobic material via computer systems;
• Serious child-protection offences (child sexual abuse material and exposing children to pornography); and
• A range of financial cybercrimes (unauthorised use/possession of payment cards, fraud using another’s credentials).
Penalties vary by offence and can include fines and imprisonment (in some cases up to 10 years), depending on the gravity of the offence.
Why the confusion about a “Cyber Crimes Act”?
A few reasons commonly cause the misunderstanding:
1. Bills, amendments and multiple Acts: Zimbabwe’s Cyber and Data Protection Act (2021) includes cybercrime elements and made consequential amendments to the Criminal Code so some readers assume the result is a new standalone law.
2. Media and social sharing: Short social posts or headlines can misstate legal technicalities (e.g., saying “a Cyber Crimes Act has been enacted” when the reality is amendments to the Criminal Code). POTRAZ explicitly cautioned against sharing unverified legal claims.
3. International developments: Zimbabwe’s recent participation in international cybercrime instruments (see below) may have added to expectations that a new national instrument would appear.
Ad
International context — the UN cybercrime convention
In late 2024 the United Nations adopted a global convention against cybercrime, and Zimbabwe appended its signature to the UN Convention against Cybercrime (the “Hanoi Convention”) during the signing ceremony in 2025. That international step signals Zimbabwe’s intent to align domestic law with international standards for cooperation and evidence-sharing in cybercrime matters but signing an international convention is separate from passing domestic laws, and does not by itself create a “Cyber Crimes Act” in Zimbabwe.
Practical takeaways for readers (what you should do)
• Don’t assume headlines are legally precise. If a social post claims a new law has been enacted, look for the official text (Government Gazette), a regulator’s notice (POTRAZ), or an authoritative legal source (e.g., ZimLII or the Government Printer). POTRAZ encourages verifying legal claims through official channels.
• If you handle data or run a website/business: review the Cyber and Data Protection Act (2021) and the amended Criminal Code to ensure compliance with data-handling, privacy and cybersecurity obligations. Seek legal advice if you’re unsure how the rules apply to your operations.
• For individuals: protect your passwords, use two-factor authentication where available, be cautious about sharing intimate images or personal data, and report suspected cybercrimes to the appropriate authorities. The law now makes many of these harmful acts criminal.
Misinformation about laws spreads quickly online; the POTRAZ clarification is a helpful reminder to rely on official notices and statute texts before sharing legal claims. Zimbabwe’s cybercrime and data-protection framework today is a mix of the Cyber and Data Protection Act (2021) and consequential amendments to the Criminal Code together these instruments criminalise a range of harmful online conduct while aligning the country more closely with international efforts to tackle cybercrime.
If you have a tip, a story, or something you want us to cover get in touch with us by clicking here. Sign up to our newsletter so you won’t miss a post and stay in the loop and updated also we will be launching a free basic cybersecurity short course for beginners to teach you how to protect yourself online. Just subscribe for free to our newsletter and create an account on Perusee to be eligible.
Note: You can also advertise on Perusee, just contact us, call or app +263 78 613 9635
Click here to Follow our WhatsApp channel
Keep comments respectful and in line with the article, also create an account and login to chat with members in our forum, get help on issues you need help with from community members.