Privacy Policy

Effective Date: 01 July 2026

1. Introduction

This Privacy Notice outlines how the National Social Security Authority ("NSSA", "the Authority") collects, uses, processes, and protects your personal data in accordance with the laws of Zimbabwe. NSSA processes personal information lawfully, fairly, and transparently, consistent with:

  • The Constitution of Zimbabwe 2013 (Section 57 – Right to Privacy and Section 62 – Access to Information)
  • Cyber and Data Protection Act [Chapter 12:07]
  • National Social Security Authority Act [Chapter 17:04]
  • Relevant Statutory Instruments governing pensions, benefits, data protection, and workers' compensation, including:
    • Statutory Instrument 155 of 2024 – Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations
    • Statutory Instrument 393 of 1993 – National Social Security Authority (Pensions and Other Benefits Scheme) (Rates and Benefits) Notice, 1993
    • Statutory Instrument 68 of 1990 – National Social Security Authority (Accident Prevention and Workers' Compensation Scheme) (Prescribed Matters) Notice, 1990

The National Social Security Authority (NSSA) is the Data Controller for all personal data processed under this Privacy Notice, as defined in the Cyber and Data Protection Act [Chapter 12:07]. By interacting with NSSA, you acknowledge that you have read and understood this notice.

2. Information Collected

2.1. From Employees / Contributors / Beneficiaries
NSSA is authorised by law to collect and process the following information as a legal obligation to fulfil its mandate:

  • Personal Identification Information – Name, national ID, date of birth, gender, marital status.
  • Contact Information – Address, phone numbers, email address, bank accounts.
  • Employment & Salary Information – Payroll records, employer details, contribution histories.
  • Dependants' Information – Names, dates of birth, relationships, national ID details where required.
  • Occupational Injury Information – Accident reports, employer submissions, medical assessments/reports, and any supporting documentation.
  • Any other personal data which NSSA may collect.

2.2. From Employers — Employers may be required to provide:

  • Payroll uploads
  • Contribution schedules
  • Employment status updates
  • Occupational injury incident reports
  • Supporting documentation for claims or benefit processing

2.3. From Job Applicants
As part of the recruitment process conducted through the NSSA website, NSSA may collect and process personal identification and contact information, educational and professional information (qualifications, CV, employment history, skills), application and recruitment information (applications, cover letters, interview records, referee details), supporting documentation, and any other personal data voluntarily provided by the applicant.

3. Purpose of Data Collection

NSSA processes personal information for the following purposes:

  • Administration of social security and pension benefits
  • Calculation and recording of contributions
  • Verification of eligibility for benefits
  • Assessment and processing of occupational injury claims
  • Management of dependants and survivor benefits
  • Fraud prevention and compliance monitoring
  • Communication with pensioners, contributors and employers
  • Employee recruitment
  • Fulfilment of legal and regulatory obligations under Zimbabwean law
4. Legal Basis for Processing

NSSA processes personal information based on: compliance with statutory obligations; execution of public interest and social security functions; performance of duties between contributors, employers, and the Authority; and where you have freely given your explicit consent for a specific purpose.

4.2. Personal Data of Minors — NSSA is committed to processing minors' data lawfully, fairly and transparently. NSSA does not knowingly collect personal data directly from minors through its online platforms without appropriate authority; such data may be collected only where necessary for the administration of statutory social security benefits or services. Where consent is required by law, NSSA obtains verifiable consent from a parent or legal guardian.

4.3. Automated Processing — NSSA does not make decisions producing legal or similarly significant effects on individuals solely through automated processing without human intervention, except where authorized by law.

5. Data Storage, Retention and Security

NSSA maintains records of personal data processing activities in accordance with the Cyber and Data Protection Act and approved records and information management policies. In line with the Act and SI 155 of 2024, NSSA implements:

  • Secure data storage systems
  • Encryption and secure transfer channels
  • Role-based access controls
  • Regular audits and monitoring
  • Measures to prevent unauthorised access, loss, or misuse
  • Data is retained only as required under Zimbabwean law

Personal Data Breach Management: In the event of a personal data breach, NSSA will take appropriate remedial action and, where required by law, notify the Data Protection Authority of Zimbabwe and affected data subjects within the prescribed timeframes.

6. Disclosure of Information

NSSA may disclose personal information where permitted by the data subject in writing or required by law, including to:

  • Government or regulatory bodies
  • Licensed medical practitioners for injury assessments
  • Approved service providers under confidentiality agreements
  • Employers, solely to verify contribution or payroll discrepancies
  • Courts, law enforcement, or investigative authorities

NSSA does not sell personal information.

7. Transfer of Information Outside Zimbabwe

Where data must be transferred outside Zimbabwe, NSSA complies with applicable sections of the Cyber and Data Protection Act and related regulations, ensuring that adequate protection safeguards exist, that transfers occur only to jurisdictions with comparable protection standards, and that consent is obtained where legally required.

8. Rights of Data Subjects

Individuals have the right to:

  • Access their personal data
  • Be informed about the collection and use of their personal information
  • Request correction of inaccurate or incomplete information
  • Object to certain types of processing
  • Request deletion where legally permissible
  • Withdraw consent for consent-based processing

Data subjects are encouraged to first lodge any complaints with the Data Controller at NSSA. If the issue remains unresolved, it may then be escalated to the Data Protection Authority of Zimbabwe.

9. Website Use and Cookies

NSSA's portals may use cookies, analytics tools, or tracking technologies consistent with the Cyber and Data Protection Act. Users may manage cookies through their browser settings.

10. Role of the Data Protection Officer

The Data Protection Officer (DPO) is responsible for overseeing NSSA's compliance with data protection laws, advising on data protection obligations, handling data subject requests, and acting as the liaison with the Data Protection Authority of Zimbabwe.

11. Contact Us

Any questions, concerns, or requests relating to this Privacy Notice or NSSA's data protection practices may be addressed to the Data Protection Officer (DPO):

Tichaona Madovi  |  dpo@nssa.org.zw  |  +263 773 407885

If unsatisfied, you can lodge a complaint with POTRAZ: https://www.potraz.gov.zw/?page_id=987

12. Changes to this Privacy Notice

NSSA may update this Privacy Notice from time to time to reflect changes in its practices or legal requirements. You will be notified of any material changes through notices on the NSSA website or through other appropriate communication channels. The "Effective Date" at the top of this notice indicates when it was last updated.

13. Consent Statement

By submitting information to NSSA or using its online services, you confirm that:

  • You have read and understood this Privacy Notice.
  • You consent to the collection and processing of personal data in accordance with Zimbabwean law.
  • You are authorised to provide information regarding dependants.
  • Employers uploading payroll information confirm its accuracy and legality.

Users who do not agree with any part of the notice are encouraged to contact NSSA before submitting data.