Zimbabwe has enacted the Data Protection Act, new legislation that makes the “transmission of data message inciting violence or damage to property” illegal and also seeks to protect against revenge pornography.

The Act was officially gazetted into law on Friday and designates the Posts and Telecommunications Regulatory Authority of Zimbabwe (Potraz) as the Data Protection Authority.

It reads in part: “Any person who unlawfully by means of a computer or information system makes available, transmits, broadcasts or distributes a data message to any person, group of persons or to the public with intend to incite such persons to commit acts of violence against any person or persons or to cause damage to any property shall be guilty of an offence.”

This has raised initial worries among some legal and human rights campaigners that this provision could be abused by the government to crackdown on protest organisers. Those found to have violated this provision are “liable to … imprisonment for a period not exceeding five years” or a fine or both fine and imprisonment.

Zimbabwe has previously cut social media and internet connectivity during period of protests. Some citizens have been dragged to the courts for social media posts deemed subversive of the government or for posts considered undermining of the authority of President Emmerson Mnangagwa.

The Data Protection Act also makes it illegal for anyone to “unlawfully and intentionally by means of a computer or information system sends any data message to another person threatening harm to the person or the person’s family or friends or damage to the property of such persons”.

It also outlaws child pornography and revenge pornography.

It stipulates that the transmission of “intimate images without consent” by means of a computer or information system “without the consent of the person concerned or with recklessness” is now an offence.

Potraz is now mandated to “regulate the manner in which personal information may be processed” and to “promote and enforce fair processing of data” as well as to regulate the transfer of personal information outside Zimbabwe.

Hacking, defined as the “unlawful” access to private personal data through use of computer program or manipulation of computer storage medium, is also outlawed under the new legislation.