My Data Protection Officer resigned. How long do I have to appoint a new DPO?
Short answer
Two clocks start when your Data Protection Officer leaves. Under SI 155 of 2024 you must notify POTRAZ within 14 days that the appointment has ended, and you must appoint a certified replacement DPO and file a new Form DP2 within 90 days.
What the law says
SI 155 requires the controller to notify the Authority of the dismissal or resignation of a DPO "within 14 days of termination" and to notify any change in the DPO's details within 14 days. The 90-day period that applied to the initial appointment is applied to replacements as well. During the gap, all the controller's obligations continue: section 19's 24-hour breach notification, section 14 data subject requests and the security duties do not pause.
Example
The DPO of a microfinance company in Chitungwiza resigns on 3 February. The company writes to POTRAZ on 10 February confirming the resignation and naming the finance manager as acting contact. It books the finance manager on the next certification course, and files a new Form DP2 with her certificate on 20 April, inside the 90 days. On 15 March a laptop with 800 borrower records is stolen; the acting contact follows the breach plan and files Form DP3 within 24 hours, because the duty never lapsed.
In practice
Name a deputy or acting contact in your breach plan so that a DPO's departure does not leave the 24-hour duty unattended. Keep the DPO's records (request log, audit notes, breach register) in a shared system rather than in their personal inbox; our compliance software exists partly to make the handover painless.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.