Business software often holds personal information about customers, staff, members or patients. Handling it responsibly protects the people concerned, maintains trust and helps the organisation meet its legal obligations.
Know your obligations
Many countries have data protection laws that set out how personal information must be collected, used and protected. In Zimbabwe, the Cyber and Data Protection Act (Chapter 12:07) establishes data protection requirements, with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) acting as the data protection authority. Requirements vary by country and sector, and organisations operating across borders may be subject to several regimes. This article is general guidance, not legal advice; consult a qualified adviser about your specific obligations.
Collect only what you need
Data minimisation is one of the simplest protections. For every field in a form or database, ask whether it is genuinely needed for the stated purpose. Information you never collect cannot be lost or misused.
Be clear about purpose
Tell people what information you collect, why, how long you keep it and who it is shared with. Use the information only for the purposes you described.
Control access
Restrict personal data to the people and systems that need it. Use role-based permissions, log access to sensitive records and review who has access regularly.
Protect it technically
- Encrypt data in transit and, for sensitive information, at rest.
- Keep systems updated and follow secure development practices.
- Protect backups with the same care as live data.
- Avoid copying personal data into test environments unless it has been anonymised.
Retain and delete deliberately
Define how long each type of personal information is kept and delete or anonymise it when it is no longer needed. Indefinite retention increases risk without adding value.
Support people’s rights
People may ask what information you hold about them, request corrections or ask for deletion, depending on the applicable law. Design systems so such requests can be handled efficiently.
Manage third parties
When a service provider processes personal data for you, such as a hosting or email provider, understand where the data is stored and what protections apply, and put appropriate agreements in place.
Prepare for breaches
Know how you would detect, contain and assess a data breach, and what notification obligations may apply. A prepared response limits harm.
Privacy works best when it is designed into software from the start rather than added as a policy afterwards.
