Do I need to notify POTRAZ every time I start a marketing campaign or hire a new supplier?
Short answer
No. Under SI 155 of 2024 you notify POTRAZ of your processing activities and of material changes to them, not of every individual marketing message or supplier contract. A new type of processing (a customer app, biometrics, foreign hosting) is worth notifying; a promotion to your existing list is not.
What the law says
Section 10 of SI 155 speaks of notifying "processing activities", which are categories of processing defined by purpose (payroll, customer sales, marketing, CCTV, recruitment), not individual operations. The Act's own rules on direct marketing (section 15: the right to object "by request and free of charge") govern how you run a campaign, not whether you must tell POTRAZ about it. Contracts with processors must exist in writing (SI 155 section 10) but need not be filed with the Authority.
Example
A furniture store in Bulawayo already declared "direct marketing to customers by SMS and WhatsApp" as an activity. Sending a Heroes' Day promotion to its 2,000 customers is not a new activity and needs no notification. Six months later it starts collecting customers' national ID photos for a hire-purchase scheme and stores them with a credit bureau in South Africa; that is a new activity (indirect collection, sensitive-adjacent data, international transfer) and should be notified.
In practice
Keep the record of processing activities at the level of purposes. When a genuinely new purpose, data type or destination appears, update the record and let the DPO decide whether a notification to POTRAZ is required. Routine operations within an existing activity do not need one.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.