Does data protection law in Zimbabwe apply to B2B companies with no consumer customers?
Short answer
Yes. Zimbabwe's Cyber and Data Protection Act applies to B2B companies because they hold personal information about individuals even when their customers are companies: their own staff, the contact persons at each client, suppliers' representatives and any sole traders they deal with.
What the law says
Personal information under section 3 is information about an identifiable natural person. A company's registration number, VAT number or turnover is not personal information. But "Tendai Moyo, Procurement Manager, +263 77…" is. The Act does not distinguish between consumer-facing and business-facing controllers; SI 155 counts data subjects, whoever they work for.
Example
A packaging manufacturer in Msasa, Harare, sells only to 140 corporate customers. It has 70 staff, holds two or three contacts per customer (about 350 people), 60 supplier contacts and a folder of 200 old CVs. Its data subject count is about 680, so it is a Tier 1 controller. Several of its customers are banks and mobile operators, which are themselves on POTRAZ's inspection list and now ask suppliers for their data controller licence number and DPO details during onboarding.
In practice
Count the people behind the companies. Put a short privacy line in your terms of trade and email footer explaining that you hold business contacts' details for the purposes of the commercial relationship. Expect your larger customers to require a data processing clause or to ask for your POTRAZ licence; having it ready is a commercial advantage.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.