The Postal and Telecommunications Act allows the government to intercept ostensibly suspicious communications (Section 98) and requires a telecommunications licensee, such as an ISP, to supply information to government officials upon request. It is not clear whether a court order is required.

The Cyber and Data Protection Act provides for a safe harbour regime in Zimbabwe. This is provided for in Section 379C(1) which states that an ISP shall not be responsible or liable for a crime if they have not initiated the transmission, selected the receiver of the transmission and/or modified the information contained in the transmission. Most importantly, the Act provides that the ISPs will not be liable for data carried on their platforms and those of intermediaries if they remove or disable after a court order. In addition, ISPs and intermediaries will not be liable if they remove the information upon their realisation or gaining knowledge that the information is illegal.

The Interception of Communications Act provides wide ranging powers to state security agencies to have access to personal data. Section 5 mandates the intelligence, defence, police and prisons services to request warrants of interception from the executive in charge of postal and telecommunication services. Section 9 of the Interception of Communications Act instructs ISPs to install necessary surveillance technologies and intercept any content that the state may deem fit. In addition, Section 9 obliges data services providers and processors to cooperate with the state in enabling data access. To this end, data processors are instructed to capture full personal information, regularly updated and use technologies that can be intercepted.
It is reported that warrants allowing the monitoring and interception of communications are issued by the Minister of Information at their discretion. Consequently, there is no adequate judicial oversight or other independent safeguard against abuse, and the extent and frequency of monitoring remains unknown.

Sections 4-7 of the Postal and Telecommunications Regulations mandates ICT services providers to obtain, record and store personal information of juristic and natural persons who are registered with these entities. Such a register is to be known as a Subscriber Register. The register is to be provided to POTRAZ or any state agency upon request and without delay. Furthermore, the regulation provides for the establishment of a Central Subscriber Database which is the consolidated portal for personal information gathered from subscribers.

Zimbabwe has not joined any free trade agreement committing to open transfers of cross-border data flows.

Zimbabwe has a comprehensive regime of data protection in place: the Cyber and Data Protection Act [Chapter 12:07] was promulgated with the policy objective of data privacy and protection of all data collected by Data Controllers both within and outside Zimbabwe depending on the location of the means used to process the said data. The Act seeks to shield the privacy of such information and regulate the way in which such information is stored, used and disclosed.

Sections 28 and 29 of the Cyber and Data Protection Act establish a framework for the cross-border transfer of data. Data can be transferred to countries that offer adequate protection. In addition, data can be transferred if it is in the public interest to do so. The data subject must provide consent to their information being transferred. However, this consent may also be implied or offered ambiguously.
Moreover, Section 11 of the Cyber and Data Protection Act prohibits the processing of sensitive personal information unless with the consent of the data subject or where processing is for legitimate purposes. Sensitive data according to Section 3 includes social, political, cultural information, as well as health and genetic information, and any information which may be considered as presenting a major risk to the rights of the data subject.

Zimbabwe has a telecommunications authority: The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ). However, it is reported that this entity is not fully independent.

It is also reported that, generally, there is a sense among private telecommunications firms that the regulator favors state-owned entities and sets onerous license fees and conditions to disadvantage private competitors. For instance, Telecel, which is partially owned by the government, reportedly has yet to pay its USD 137.5 million license fee to POTRAZ. Furthermore, several telecommunication companies report that licenses fee requirements have been used to undermine private companies, as the state-owned firms have not been forced to pay the full amount.

Zimbabwe has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that Zimbabwe does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there is an obligation of accounting separation.

The Postal and Telecommunications Regulatory Authority, according to Section 36 of the Postal and Telecommunications Act, only issues telecommunications licenses to legal entities in which Zimbabwean citizens hold a "controlling interest", directly or indirectly. However, a license may be issued to a legal entity without such a majority shareholding, provided that within a time period set out in the license, one or more such persons acquire a majority shareholding. A "controlling interest" means that any of the following conditions are met: holding a majority of the shares of the entity; the shares represent more than 50% of the share capital of the entity; the shares are worth more than half of the share capital of the entity; or the shares give their holders a majority or a preponderance of votes in the affairs of the entity.
In addition, the Postal and Telecommunications (Licensing, Registration, and Certification) (Amendment) Regulations mandate that Public Licensees with foreign shareholding pay initial license fees in USD proportionate to the foreign shareholding percentage (Subitem 12 in second schedule-Part I). This is in contrast to the fixed scheduled initial fees payable by public licensees without foreign shareholding. By implication, the higher the shareholding proportion by foreigners, the higher the initial fees. Furthermore, the Regulations establish two categories for internet service providers in Zimbabwe. Class A is permitted to offer services like international bandwidth sales, VOIP, and video, while Class B is responsible for nationwide Internet provision. Those obtaining Class A licenses are required to pay a registration fee of $5.5 million, while Class B licenses have a fee of $2.75 million. Cell phone service licenses have even higher costs, with an establishment fee of $137.5 million.

In Zimbabwe, state-owned companies play a dominant role in the telecommunications sector. The government owns a significant stake in two of the three mobile service providers, including full ownership of NetOne and 60% ownership of Telecel. In addition, the state owns the only fixed-line service provider, TelOne. As for the main operators of the national network infrastructure, TelOne controls about 24% of the country's bandwidth capacity and about 23% of the revenues generated by the Internet. On the other hand, Powertel, belonging to the Zimbabwe Electricity Supply Authority, controlled 4.3% of the country's bandwidth capacity.

It is reported that there is an obligation for passive infrastructure sharing in Zimbabwe to deliver telecom services to end users. It is practiced in the mobile sector and in the fixed sector based on commercial agreements.

Zimbabwe has no rules applicable to the protection of trade secrets.