Can POTRAZ shut down a business for data protection non-compliance?
Short answer
POTRAZ does not close companies, but it can refuse, suspend or revoke your data controller licence and order you to stop unlawful processing. Because almost everything a business does involves personal information, a stop order or a revoked licence has much the same effect as a closure until you comply.
What the law says
SI 155 conditions the licence on compliance and gives POTRAZ the power to refuse and, by implication, to suspend or revoke it; processing without a valid licence is an offence. Section 6 of the Act gives the Authority its enforcement functions. Section 34 provides that "any person aggrieved by the decision of the Authority may appeal to the Administrative Court"; an appeal does not itself suspend your obligations under the Act.
Example
A Harare debt collector's licence is suspended after POTRAZ upholds complaints about disclosure of debts to employers. Without a licence it cannot lawfully process the personal information of the debtors it is paid to pursue, so its revenue stops even though no court has ordered it to close. It appeals, remediates (processing agreements, a script for contact, a DPO who signs off on disclosures) and applies for reinstatement; the two months without a licence cost more than five years of compliance would have.
In practice
Treat licence conditions as operating conditions. Respond to POTRAZ correspondence promptly and completely; most suspensions follow silence or repeated non-cooperation. If you receive an adverse decision, take legal advice immediately because appeal time limits are short.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.