Children's data carries the highest obligations
Children are a vulnerable category of data subject under Zimbabwe’s data protection framework. They cannot be expected to understand what they are consenting to, what is being collected about them, or how it might later be used. The law compensates for that by placing heightened obligations on the organisations doing the processing.
- Intent does not matter
- The obligations attach to services children can access, not to services designed for them. A contact form or login is enough to bring you in scope.
- Consent cannot be assumed
- Non-essential processing of a child’s data needs genuine, verifiable parental or guardian consent. A tick-box does not satisfy it.
- Exposure runs wider than the CDPA
- Organisations that fail to comply face enforcement under data protection law and potentially under other child protection frameworks too.
Does this apply to your organisation?
The risk is not hypothetical. Schools, health providers, sports clubs, churches, media organisations and retailers have all been caught by obligations they did not know applied to them. If any of the following describes you, SI 156 is in scope.
- Schools and ECD centres with online portals or communication platforms
- Higher education institutions enrolling students under 18
- Health providers offering digital patient access
- Sports clubs and associations with member registration systems
- Churches and faith organisations with online communities
- Media and entertainment platforms accessible by children
- Retailers with e-commerce sites that children can access
- Any organisation whose website has a contact form, subscription or login
What SI 156 of 2024 requires
The regulation establishes six specific obligations for organisations processing children’s personal data online.
Age-appropriate design
Services likely to be accessed by children must be designed with their best interests in mind, and default settings must be the most privacy-protective option.
Consent requirements
Processing children's data for non-essential purposes requires parental or guardian consent, through a mechanism that is genuine and verifiable.
Data minimisation
Collect only the minimum necessary. Collection beyond what the service strictly needs is a specific breach of SI 156.
Transparent information
Privacy information must be in plain, age-appropriate language. Complex legal notices do not satisfy transparency when the audience includes children.
No harmful processing
Processing detrimental to children's wellbeing — certain profiling, behavioural advertising and location tracking — is restricted or prohibited outright.
DPIA requirement
High-risk processing of children's data must be preceded by a Data Protection Impact Assessment. This is an obligation, not a recommendation.