NSSA ONLINE PRIVACY NOTICE – Last Updated 1 July 2026
National Social Security Authority Online Privacy Notice
Effective Date: 01 July 2026
1. Introduction
This Privacy Notice outlines how the National Social Security Authority (“NSSA”, “the Authority”) collects, uses, processes, and protects your personal data in accordance with the laws of Zimbabwe. NSSA processes personal information lawfully, fairly, and transparently, consistent with:
1.1. The Constitution of Zimbabwe 2013 (Section 57 – Right to Privacy and Section 62 – Access to Information)
1.2. Cyber and Data Protection Act [Chapter 12:07]
1.3. National Social Security Authority Act [Chapter 17:04]
1.4. Relevant Statutory Instruments governing pensions, benefits, data protection, and workers’ compensation, including:
1.4.1. Statutory Instrument 155 of 2024 – Cyber and Data Protection(Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations
1.4.2. Statutory Instrument 393 of 1993 – National Social Security Authority (Pensions and Other Benefits Scheme) (Rates andBenefits) Notice, 1993
1.4.3. Statutory Instrument 68 of 1990 – National Social Security Authority (Accident Prevention and Workers’ Compensation Scheme) (Prescribed Matters) Notice, 1990 .The National Social Security Authority (NSSA) is the Data Controller for all personal data processed under this Privacy Notice, as defined in the Cyber and Data Protection Act [Chapter 12:07]. By interacting with NSSA, you acknowledge that you have read and understood this notice.
2. Information Collected
2.1. From Employees / Contributors / Beneficiaries
NSSA is authorised by law to collect and process the following information as a legal obligation to fulfil its mandate:
2.1.1 Personal Identification Information
Name, national ID, date of birth, gender, marital status.
2.1.2 Contact Information
Address, phone numbers, email address, bank accounts
2.1.3 Employment & Salary Information
Payroll records, employer details, contribution histories.
2.1.4 Dependants’ Information
Names, dates of birth, relationships, national ID details where required.
2.1.5 Occupational Injury Information
Accident reports, employer submissions, medical assessments/reports, and any supporting documentation;
2.1.6 Any other personal data which NSSA may collect
2.2. From Employers
Employers may be required to provide:
2.1.7 Payroll uploads
2.1.8 Contribution schedules
2.1.9 Employment status updates
2.1.10 Occupational injury incident reports
2.1.11 Supporting documentation for claims or benefit processing
2.3. From Job Applicants
As part of the recruitment process conducted through the NSSA website,NSSA may collect and process the following personal information:
2.1.12 Personal Identification Information
Name, national ID/passport number, date of birth, gender.
2.1.13 Contact Information
Address, telephone number(s), email address.
2.1.14 Educational and Professional Information Academic qualifications, professional certifications, curriculum vitae (CV), employment history, skills, and competencies.
2.1.15 Application and Recruitment Information Job applications, cover letters, interview records, assessment results, and referee details.
2.1.16 Supporting Documentation
Copies of identity documents, certificates, transcripts, and any other documents submitted in support of the application.
2.1.17 Any Other Personal Data
Any additional personal information voluntarily provided by the applicant during the recruitment process.
3. Purpose of Data Collection
NSSA processes personal information for the following purposes:
3.1. Administration of social security and pension benefits
3.2. Calculation and recording of contributions
3.3. Verification of eligibility for benefits
3.4. Assessment and processing of occupational injury claims
3.5. Management of dependants and survivor benefits
3.6. Fraud prevention and compliance monitoring
3.7. Communication with pensioners, contributors and employers
3.8. Employee recruitment
3.9. Fulfilment of legal and regulatory obligations under Zimbabwean law
4. Legal Basis for Processing
4.1. NSSA processes personal information based on:
4.1.1 Compliance with statutory obligations
4.1.2 Execution of public interest and social security functions
4.1.3 Performance of duties between contributors, employers, and the Authority
4.1.4 Where you have freely given your explicit consent for a specific purpose
4.2. Personal Data of Minors
NSSA recognizes the importance of protecting the privacy and personal data of minors and is committed to processing such data lawfully, fairly, and transparently.
4.2.1 NSSA does not knowingly collect personal data directly from minors through its online platforms without appropriate authority.
Personal data relating to minors may be collected only where necessary for the administration of statutory social security benefits or services.
4.2.2 Where consent is required by law, NSSA ensures that verifiable consent is obtained from a parent or legal guardian before collecting or processing a minor’s personal data
4.3. Automated Processing
NSSA does not make decisions producing legal or similarly significant effects on individuals solely through automated processing without human intervention, except where such processing is authorized by law.
5. Data Storage, Retention and Security
5.1 NSSA maintains records of personal data processing activities in accordance with the Cyber and Data Protection Act and approved records and information management policies.
5.2 In line with the Cyber and Data Protection Act and SI 155 of 2024, NSSA implements:
5.2.1 Secure data storage systems
5.2.2 Encryption and secure transfer channels
5.2.3 Role-based access controls
5.2.4 Regular audits and monitoring
5.2.5 Measures to prevent unauthorised access, loss, or misuse
5.2.6 Data is retained only as required under Zimbabwean law.
5.3 Personal Data Breach Management: In the event of a personal data breach, NSSA will take appropriate remedial action and, where required by law, notify the Data Protection Authority of Zimbabwe and affected data subjects within the prescribed timeframes.
6. Disclosure of Information
NSSA may disclose personal information where permitted by the data subject in writing or required by law, including to:
6.1 Government or regulatory bodies
6.2 Licensed medical practitioners for injury assessments
6.3 Approved service providers under confidentiality agreements
6.4 Employers, solely to verify contribution or payroll discrepancies
6.5 Courts, law enforcement, or investigative authorities
NSSA does not sell personal information.
7. Transfer of Information Outside Zimbabwe
Where data must be transferred outside Zimbabwe, NSSA complies with applicable sections of the Cyber and Data Protection Act and related regulations, ensuring that:
7.1 Adequate protection safeguards exist
7.2 Transfers occur only to jurisdictions with comparable protection standards
7.3 Consent is obtained where legally required
8. Rights of Data Subjects
Individuals have the right to:
8.1 Access their personal data
8.2 Be informed about the collection and use of their personal information
8.3 Request correction of inaccurate or incomplete information
8.4 Object to certain types of processing
8.5 Request deletion where legally permissible
8.6 Withdraw consent for consent-based processing
8.7 Data subjects are encouraged to first lodge any complaints with the Data Controller at NSSA. If the issue remains unresolved, it may then be escalated to the Data Protection Authority of Zimbabwe
9. Website Use and Cookies
NSSA’s portals may use cookies, analytics tools, or tracking technologies consistent with the Cyber and Data Protection Act. Users may manage cookies through their browser settings.
10. Role of the Data Protection Officer
The Data Protection Officer (DPO) is responsible for overseeing NSSA’s compliance with data protection laws, advising on data protection obligations, handling data subject requests, and acting as the liaison with the Data Protection Authority of Zimbabwe.
11. Contact Us
Any questions, concerns, or requests relating to this Privacy Notice or NSSA’s data protection practices may be addressed to the Data Protection Officer (DPO) at the contact details listed below:
Tichaona Madovi | dpo@nssa.org.zw |+263 773 407885
If unsatisfied, you can lodge a complaint with POTRAZ on the following link: https://www.potraz.gov.zw/?page_id=987
12. Changes to this Privacy Notice
NSSA may update this Privacy Notice from time to time to reflect changes in its practices or legal requirements. You will be notified of any material changes through notices on the NSSA website or through other appropriate
communication channels. The “Effective Date” at the top of this notice indicates when this Privacy Notice was last updated.
13. Consent Statement
By submitting information to NSSA or using its online services, you confirm that:
• You have read and understood this Privacy Notice.
• You consent to the collection and processing of personal data in accordance with Zimbabwean law.
• You are authorised to provide information regarding dependants.
• Employers uploading payroll information confirm its accuracy and legality.
Users who do not agree with any part of the notice are encouraged to contact NSSA before submitting data.