According to section 28 of the Act, data controllers may not transfer personal information to a third party in a foreign country unless an adequate level of protection is ensured. This adequacy is assessed based on the circumstances surrounding the transfer, including the nature of the data, the purpose and duration of processing, the recipient, the recipient country's data protection laws, and professional rules and security measures.

Data controllers must notify the Authority of any intention to transfer or share data outside of Zimbabwe.