Does the Cyber and Data Protection Act apply to small businesses in Zimbabwe?
Short answer
Yes, the Cyber and Data Protection Act (CDPA) applies to small businesses in Zimbabwe. There is no small-business exemption in the Act or in SI 155 of 2024; what changes with size is the POTRAZ licence tier and therefore the fee, which starts at USD 50 a year.
What the law says
Section 3 of the Act defines a data controller as any natural or legal person who determines the purpose and means of processing personal information, and the Act applies to processing "wholly or partly by automated means" as well as to manual filing systems. SI 155 of 2024 then requires every data controller to be licensed, and its First Schedule places the smallest controllers (50 to 1,000 data subjects) in Tier 1 at USD 50 a year. Nowhere does either text say "except small businesses".
Example
A two-person bookkeeping practice in Gweru holds the ID numbers, bank details and payslips of 120 client employees to run their payroll, plus its own two staff files and 35 client contacts. That is roughly 157 data subjects. The practice is a Tier 1 data controller and also a data processor for its clients, and it needs a POTRAZ licence and a Data Protection Officer just as a bank does; the difference is that its licence costs USD 50 rather than USD 2,500.
In practice
Count the people whose information you hold (staff, applicants, customers, suppliers' contacts), identify your tier, appoint a DPO and apply on Form DP1. Banks and telecoms are simply first on POTRAZ's 2026 inspection list; they are not the only ones covered, and complaints from customers or ex-employees reach small businesses at any time.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.