Does a DPO in Zimbabwe have to be a Zimbabwean citizen or resident?
Short answer
No. Zimbabwean citizenship is not required for a Data Protection Officer. What SI 155 of 2024 requires is knowledge of Zimbabwe's data protection law, the POTRAZ-approved certification (USD 1,450 for international candidates versus USD 1,250 for citizens) and the ability to perform the role, including being reachable by POTRAZ and by your data subjects.
What the law says
Section 13 of SI 155 requires "knowledge of national data protection laws and practices" and an understanding of the controller's operations, and the certification requirement applies to every DPO. The Second Schedule's separate "international" fee shows that non-citizens are expected to take the course. Nothing in the Act or SI 155 recognises foreign certifications (for example under the EU GDPR) as equivalent.
Example
A UK-headquartered NGO operating in Harare and Mutare proposes its London-based GDPR-certified privacy officer as DPO for the Zimbabwean entity. POTRAZ requires the Zimbabwean certification; the officer takes the course (USD 1,450) or, more practically, the NGO certifies its Harare country administrator (USD 1,250) and names her on Form DP2, with the London officer as group support. Either way, someone reachable during Zimbabwean business hours must be the point of contact.
In practice
If your group has foreign privacy staff, use them for policy and support, but appoint a POTRAZ-certified DPO who can attend an inspection, answer a data subject and file a Form DP3 within 24 hours. Foreign expertise plus local certification is the workable combination.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.