What happens if I ignore the Cyber and Data Protection Act in Zimbabwe?
Short answer
Until September 2026, in many cases nothing, which is why so many businesses did. That has changed. POTRAZ began mandatory, risk-based inspections on 1 September 2026; being found without a licence is an offence carrying up to seven years' imprisonment, without a DPO up to two years, and POTRAZ can order you to stop processing. Any customer or employee can complain at any time.
What the law says
SI 155 makes processing without a licence after the transition period an offence with "a fine not exceeding level 11 or imprisonment for a period not exceeding seven years or both", and failing to appoint a DPO an offence at level 7 or two years. Section 33 of the Act applies the level 11 / seven-year penalty to breaches of the core duties (sections 11, 13, 18, 24 and 28). Section 6 gives POTRAZ the functions of investigating complaints and ensuring lawful processing, and SI 155 conditions the licence on compliance, so suspension or revocation is available. POTRAZ's July 2026 notice announced inspections of nine priority sectors from 1 September 2026.
Example
A funeral assurance company in Harare with 60,000 policyholders decided in 2025 that compliance was "for banks". In September 2026 it is inspected as an insurer, the second priority sector. It has no licence, no DPO, no processing record, no processor contracts with its 200 agents, and no breach plan. Each of those is a separate finding; the first two are criminal offences; and its bank has just asked for its licence number as part of its own compliance review.
In practice
Assume you will be asked, by POTRAZ, by a bank or by an unhappy customer. The two criminal exposures (licence, DPO) can be removed in two weeks; the rest follows over six to eight weeks (Q98).
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.