Can DPO training and data protection training be done online in Zimbabwe?
Short answer
Often, yes. SI 155 of 2024 fixes the outcome, a POTRAZ-approved course and a passed examination, not the delivery method, so approved providers set their own format and examinations are commonly invigilated. Staff awareness and management sessions have no format rules and can be delivered entirely online.
What the law says
SI 155 says only that the DPO must "undergo a certification course approved by the Authority"; the format is for the approved provider and POTRAZ to determine under the 2025 Guidelines. For staff training, section 18 of the Act and section 16 of SI 155 require organisational measures and evidence that they are effective; a completion log and quiz results from an online session meet that standard as well as a signed paper register.
Example
A mining company with sites in Zvishavane, Hwange and Harare cannot bring 400 employees to one room. It runs its annual awareness training as a 45-minute online module with a quiz, completed on site computers and phones, and exports the completion report for the DPO's file. Its DPO attended the certification course in person in Harare because that was the accredited provider's format at the time.
In practice
Ask accredited providers whether they offer online or blended delivery for the certification and how the examination is invigilated. For staff training, choose whatever format gets everyone through it every year, and keep the completion evidence.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.