What CDPA training does Business Science Institute offer, and which parts are compulsory?
Short answer
Business Science Institute offers three tracks. The DPO track prepares your named Data Protection Officer for the certification examination and for the day-to-day role; the owner / director track is a short briefing on the decisions that belong to management; the staff awareness track is the annual 60- to 90-minute session for all employees. Only the DPO certification is compulsory by law.
What the law says
SI 155 makes the DPO certification mandatory and subject to POTRAZ approval, so ask us for the current status of that approval before enrolling, exactly as you should ask any provider. Owner and staff training are not prescribed courses; they are how a controller discharges the organisational-measures duty in section 18 of the Act and section 16 of SI 155, and how the DPO performs the training function in section 14 of SI 155.
Example
A Tier 2 retail group in Harare uses all three. Its compliance manager takes the DPO track ahead of the certification examination. Its five directors attend a two-hour briefing covering licensing tiers, the DPO's independence, the 24-hour breach duty and their own exposure under section 33, and leave with a one-page board checklist. Its 260 staff complete the awareness session in branch groups over one month, and the completion registers go into the compliance software.
In practice
Start with the DPO track (compulsory), add the director briefing so that the DPO's advice lands with people who understand it, and schedule the staff session annually so that it doubles as evidence for inspections and as CPD for the DPO.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.