POTRAZ, DPO and CDPA: 100 questions answered for Zimbabwean organisations
Everything a data controller in Zimbabwe asks about the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ's 2025 Implementation Guidelines. Each answer gives you the position, the section it comes from, a realistic Zimbabwean example and what to do next. Search it, or work through a category.
Explore by category
Eight categories covering scope, licensing, the Data Protection Officer, training, tooling, penalties, day-to-day obligations, and what the whole exercise costs.
Does the CDPA apply to me?
Whether the Cyber and Data Protection Act reaches small businesses, sole traders, NGOs, churches, schools, B2B companies, paper files, WhatsApp lists and foreign sellers, and whether you are a data controller or a data processor.
Open this categoryPOTRAZ licence and fees
Tiers and fees under SI 155 of 2024, Form DP1, what documents you need, renewals, tier upgrades mid-year, group companies, late registration and whether POTRAZ can refuse or revoke a licence.
Open this categoryData Protection Officer
Whether a Data Protection Officer is mandatory, whether you can appoint yourself, certification and exams, shared and outsourced DPOs, the 90-day replacement rule, personal liability of the DPO and of directors.
Open this categoryDPO and staff training
Whether data protection training is legally required, what frontline staff need, the cost and duration of DPO certification, which institutions POTRAZ approves, online delivery, and how to evidence training to an inspector.
Open this categoryCompliance software
Whether compliance software is required by law, what it should actually do for a Zimbabwean controller, where the data may be hosted, automated breach reporting, and whether Excel and WhatsApp are good enough.
Open this categoryPenalties and inspections
Fines in US dollars, prison terms, what POTRAZ checks during an inspection, how likely an inspection is, complaints from customers and ex-employees, director liability, civil claims and late registration.
Open this categoryDay-to-day obligations
Privacy notices, lawful grounds and consent, processor contracts, the 24-hour breach notification, subject access requests, erasure against tax retention, biometrics, CCTV signage, children's data, DPIAs and foreign hosting.
Open this categoryCost and timeline
Total first-year cost for a small business, whether you need a lawyer, how long compliance takes from zero, what to do this week, and the minimum checklist.
Open this categoryPOTRAZ, DPO and CDPA key numbers
The figures and deadlines people look up most often, with the provision each one comes from.
| Question | Answer | Source |
|---|---|---|
| Who regulates data protection in Zimbabwe? | POTRAZ (Data Protection Authority) | Act s.5 |
| Who is exempt from the POTRAZ licence? | Personal/household use; journalistic, historical, archival (still register); law enforcement | SI 155 s.8 |
| Lowest POTRAZ licence tier | 50 data subjects | SI 155 First Schedule |
| POTRAZ licence fees | T1 (50–1,000) USD 50; T2 (1,001–100,000) USD 300; T3 (100,001–500,000) USD 500; T4 (>500,000) USD 2,500; T2–T4 application fee USD 30 | SI 155 Second Schedule |
| Licence validity / renewal | 12 months; renew at least 3 months before expiry (Form DP1) | SI 155 |
| POTRAZ decision on application | 14 days | SI 155 |
| Deadlines for existing controllers | 12 March 2025 (licence); 12 December 2024 (DPO) | SI 155 |
| Is a DPO mandatory? | Yes, for every data controller; Form DP2; changes within 14 days; replacement within 90 days | SI 155 ss.11–14 |
| DPO certification fee | USD 1,250 (citizens) / USD 1,450 (international) | SI 155 Second Schedule |
| Data breach to POTRAZ | Within 24 hours (Form DP3) | Act s.19; SI 155 |
| Data breach to individuals | Within 72 hours if high risk | SI 155; POTRAZ Breach Guidelines 2025 |
| Reply to POTRAZ breach queries | 14 days; POTRAZ aims to close within 21 days | SI 155 |
| Children | Under 18; parental/guardian consent; DPIAs; no ad profiling | Act ss.3, 26; SI 155 s.10 |
| Sensitive data (health, biometrics, beliefs, criminal record…) | Written consent or narrow exception | Act ss.11–12 |
| Lawful grounds (non-sensitive data) | Consent; legal obligation; vital interests; public task; evidence of an offence; legitimate interests | Act s.10 |
| Penalty: no licence / core breaches | Fine up to level 11 (USD 1,000) or up to 7 years, or both | Act s.33; SI 155 |
| Penalty: no DPO | Fine up to level 7 (USD 400) or up to 2 years, or both | SI 155 |
| Appeals against POTRAZ | Administrative Court | Act s.34 |
| POTRAZ inspections | From 1 September 2026, risk-based, nine priority sectors | POTRAZ notice, July 2026 |
Fine amounts follow the Standard Scale of Fines Notice (SI 14A of 2023) and are updated by Government from time to time.
All 100 questions
Every question has its own page with the position, the section of the Act or of SI 155 it comes from, a realistic Zimbabwean example and what to do about it.
Does the CDPA apply to me? — 15 questions
- Q1 Does the Cyber and Data Protection Act apply to small businesses in Zimbabwe?
- Q2 Do I need a POTRAZ data controller licence if I only have employees and no customer database?
- Q3 Is a business with fewer than 50 data subjects exempt from the POTRAZ licence in Zimbabwe?
- Q4 Does the CDPA apply to sole traders and informal traders in Zimbabwe?
- Q5 Does data protection law in Zimbabwe apply to B2B companies with no consumer customers?
- Q6 Does the Cyber and Data Protection Act cover paper records in Zimbabwe?
- Q7 Is keeping customer numbers on WhatsApp "processing personal data" under Zimbabwe's CDPA?
- Q8 Do NGOs, churches and schools need a POTRAZ data controller licence in Zimbabwe?
- Q9 Who is exempt from the POTRAZ data controller licence under SI 155 of 2024?
- Q10 Does a foreign company selling online to Zimbabweans need to comply with the CDPA and POTRAZ?
- Q11 Am I a data controller or a data processor under Zimbabwe's Cyber and Data Protection Act?
- Q12 Who is responsible under the CDPA when agents or sales reps collect customer data for my business?
- Q13 Is there a turnover threshold for POTRAZ data protection registration in Zimbabwe?
- Q14 When did the POTRAZ licence and DPO requirements start in Zimbabwe, and are they enforced?
- Q15 Is POTRAZ data protection compliance really necessary or just another tax?
POTRAZ licence and fees — 15 questions
- Q16 Do I need a POTRAZ licence to hold customer data in Zimbabwe?
- Q17 How much does a POTRAZ data controller licence cost in Zimbabwe?
- Q18 Is the POTRAZ data protection licence fee paid once or every year?
- Q19 How do I know which POTRAZ licence tier my business is in?
- Q20 Can a group of companies share one POTRAZ data controller licence?
- Q21 What documents do I need to apply for a POTRAZ data controller licence?
- Q22 Do I need the POTRAZ licence before I start trading, or can I register later?
- Q23 My business grew into a higher POTRAZ licence tier. Do I have to upgrade mid-year?
- Q24 What happens if I forget to renew my POTRAZ data controller licence?
- Q25 Are there hidden POTRAZ charges beyond the licence fee?
- Q26 Do I have to register CCTV, my website or my mobile app separately with POTRAZ?
- Q27 Do I need to notify POTRAZ every time I start a marketing campaign or hire a new supplier?
- Q28 Does my ZIMRA tax clearance or shop licence count as POTRAZ data protection registration?
- Q29 If I pay the POTRAZ licence fee, am I fully compliant with the CDPA?
- Q30 Can POTRAZ refuse, suspend or revoke my data controller licence?
Data Protection Officer — 20 questions
- Q31 Is a Data Protection Officer (DPO) mandatory in Zimbabwe?
- Q32 Does appointing a DPO in Zimbabwe mean hiring a full-time employee?
- Q33 How much does a Data Protection Officer cost in Zimbabwe?
- Q34 Can a business owner be their own Data Protection Officer in Zimbabwe?
- Q35 Can my accountant, lawyer or IT provider act as my Data Protection Officer?
- Q36 Does a DPO in Zimbabwe have to pass an exam?
- Q37 My Data Protection Officer resigned. How long do I have to appoint a new DPO?
- Q38 Is the Data Protection Officer personally liable under Zimbabwe's CDPA?
- Q39 Does a DPO in Zimbabwe have to be a Zimbabwean citizen or resident?
- Q40 Can several companies share one Data Protection Officer in Zimbabwe?
- Q41 What are the duties of a Data Protection Officer under SI 155 of 2024?
- Q42 Can I appoint a DPO now and complete the POTRAZ certification later?
- Q43 Is annual DPO training (CPD) required in Zimbabwe?
- Q44 Do I have to notify POTRAZ when my DPO's contact details change?
- Q45 Which businesses in Zimbabwe do not need a Data Protection Officer?
- Q46 What is the penalty for not appointing a Data Protection Officer in Zimbabwe?
- Q47 Can a junior employee be the Data Protection Officer to save money?
- Q48 Does the Data Protection Officer have to be independent from management?
- Q49 Are company directors personally liable if there is no POTRAZ licence or DPO?
- Q50 What is the fastest way to appoint a compliant Data Protection Officer in Zimbabwe?
DPO and staff training — 8 questions
- Q51 Is data protection training legally required in Zimbabwe?
- Q52 Do frontline staff need data protection training under Zimbabwe's CDPA?
- Q53 How much does DPO certification cost in Zimbabwe and how long does it take?
- Q54 Which institutions are approved by POTRAZ for DPO training in Zimbabwe?
- Q55 Can DPO training and data protection training be done online in Zimbabwe?
- Q56 What CDPA training does Business Science Institute offer, and which parts are compulsory?
- Q57 What happens if I skip data protection training in Zimbabwe?
- Q58 How do I prove to POTRAZ that data protection training took place?
Compliance software — 7 questions
- Q59 Is data protection compliance software required by law in Zimbabwe?
- Q60 What should CDPA compliance software do for a Zimbabwean business?
- Q61 Does buying compliance software make me CDPA-compliant automatically?
- Q62 Can I use Excel, Google Sheets and WhatsApp for customer data under Zimbabwe's CDPA?
- Q63 Where is data stored in compliance software, and is foreign hosting allowed under the CDPA?
- Q64 Can compliance software report a data breach to POTRAZ automatically?
- Q65 How does the cost of compliance software compare with CDPA fines in Zimbabwe?
Penalties and inspections — 15 questions
- Q66 What happens if I ignore the Cyber and Data Protection Act in Zimbabwe?
- Q67 What are the data protection fines in Zimbabwe in US dollars?
- Q68 Can you go to prison for not registering with POTRAZ as a data controller?
- Q69 How likely is a POTRAZ inspection for a small business in Zimbabwe?
- Q70 Can a customer or former employee report my business to POTRAZ?
- Q71 What does POTRAZ check during a data protection inspection?
- Q72 Can POTRAZ shut down a business for data protection non-compliance?
- Q73 Is not knowing about the CDPA a defence in Zimbabwe?
- Q74 Will I be punished for registering late with POTRAZ?
- Q75 What happens if I do not report a data breach to POTRAZ?
- Q76 Can customers sue my business for misusing their data in Zimbabwe?
- Q77 Do banks and large clients in Zimbabwe ask for your POTRAZ licence number?
- Q78 What are the consequences of CDPA non-compliance for directors and managers?
- Q79 Can POTRAZ enforce the CDPA against a foreign company?
- Q80 Is POTRAZ extending the data protection licence deadline or offering an amnesty?
Day-to-day obligations — 15 questions
- Q81 Do I need a privacy notice on my website and forms in Zimbabwe?
- Q82 Do I need consent to process personal data under Zimbabwe's CDPA, including payroll?
- Q83 Do I need written contracts with my accountant, payroll bureau and IT company under SI 155?
- Q84 Do I have to report every data breach to POTRAZ within 24 hours?
- Q85 Do I have to give a customer all the data I hold about them (data subject access request)?
- Q86 Must I delete a customer's data on request if I need it for tax records?
- Q87 Is written consent required for fingerprint or biometric attendance systems in Zimbabwe?
- Q88 Do I need CCTV signs under Zimbabwe's data protection law?
- Q89 Is parental consent required for children's data under Zimbabwe's CDPA?
- Q90 Is a Data Protection Impact Assessment (DPIA) mandatory in Zimbabwe?
- Q91 Do I need POTRAZ approval to use Google Workspace, Microsoft 365 or a South African server?
- Q92 Do I have to stop using WhatsApp for customer communication under the CDPA?
- Q93 Do I have to keep a record of processing activities under Zimbabwe's CDPA?
- Q94 Can I buy or use a purchased customer list under Zimbabwe's data protection law?
- Q95 What is the right order: POTRAZ licence first, or Data Protection Officer first?
Cost and timeline — 5 questions
- Q96 What is the total cost of POTRAZ data protection compliance for a small business?
- Q97 Do I need a lawyer for POTRAZ data protection compliance, or can I do it myself?
- Q98 How long does it take to become CDPA-compliant in Zimbabwe from zero?
- Q99 What should I do this week if my business has done nothing about POTRAZ compliance?
- Q100 What is the minimum CDPA compliance checklist for a Zimbabwean business?
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.