Data Protection Awareness, Regulatory Literacy and Trust in Data-Handling Organisations: Evidence from a National Survey in Zimbabwe

Data protection laws have spread quickly across developing countries, but enactment has often run ahead of citizens’ awareness and of the capacity to turn statutory rights into practical protection. This study examines that gap in Zimbabwe, whose Cyber and Data Protection Act came into force in December 2021, using a 2023 national survey of 1193 adults in all ten provinces, collected for the national regulator, and multivariable regression. Awareness was low and uneven: only 27.9% had heard of the Act, and education alone accounted for 30.8% of the variance in an Awareness Index. Perceived regulatory literacy, a self-assessed measure of personal capability, was positively associated with trust in data-handling organisations once factual awareness was controlled, while awareness itself was weakly and negatively associated with trust; both trust models explained less than 5% of the variance. Literacy was strongly associated with self-reported knowledge of how to opt out of unsolicited communications (odds ratio = 3.09), but neither awareness nor literacy was associated with willingness to share personal information, and higher trust was associated with less scrutiny of cookie notices. These cross-sectional associations provide a baseline for data protection outreach in Zimbabwe and hypotheses for comparative research.