Do I have to notify POTRAZ when my DPO's contact details change?
Short answer
Yes, within 14 days. SI 155 of 2024 requires any change in the Data Protection Officer's details, and any termination of the appointment, to be notified to POTRAZ within 14 days. It is a two-minute task with a real purpose: POTRAZ and your data subjects must always be able to reach the right person.
What the law says
SI 155 provides that the controller shall notify the Authority of any changes to the DPO's particulars "within a period of 14 days", and of a DPO's dismissal or resignation "within 14 days of termination". Section 14 makes the DPO the contact point for data subjects, and sections 15 and 16 of the Act require your privacy notice to identify how people can exercise their rights, which in practice means the DPO's contact details must be correct wherever they are published.
Example
A hotel in Victoria Falls changes its email domain and moves the DPO from the finance office to a new compliance office with a new extension. The old address on Form DP2 bounces. A guest who wants her data deleted emails the published address, receives no reply, and complains to POTRAZ, which finds that its own record of the DPO is out of date. A 14-day update would have avoided both the complaint and the finding.
In practice
Whenever the DPO's name, email, phone or employer changes, send POTRAZ a short update referencing the licence number and update your privacy notice, website and forms on the same day. Add "DPO contact details current?" to the quarterly compliance checklist.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.