What should I do this week if my business has done nothing about POTRAZ compliance?
Short answer
Five actions. (1) Count how many people's data you hold and note your POTRAZ tier. (2) Choose your Data Protection Officer and book the POTRAZ-approved certification, or engage an external certified DPO. (3) Download Forms DP1 and DP2, complete them, pay the tier fee and file. (4) Tell staff in writing that customer and employee data stays on company-controlled systems and that any suspected breach goes to the DPO immediately. (5) Diarise the licence renewal and the DPO's CPD.
What the law says
Actions 1 to 3 satisfy SI 155's licensing and DPO requirements (First Schedule tiers, Forms DP1 and DP2, certification). Action 4 is the first organisational measure under section 18 of the Act and gives you a fighting chance of meeting the 24-hour breach deadline in section 19. Action 5 addresses SI 155's three-month renewal rule and the CPD obligation in section 10.
Example
The owner of a Harare panel-beating business with 35 staff and 1,500 customer records does this on a Monday. Morning: she counts 1,650 data subjects (Tier 2) from the payroll and job-card system. Midday: she appoints her workshop administrator as DPO by letter and pays the course deposit. Afternoon: she completes Forms DP1 and DP2, pays USD 330 and USD 30, and files. Tuesday: a one-page memo to all staff on data handling and breach escalation, signed by each. Wednesday: renewal and CPD dates in the shared calendar. By Wednesday evening the two criminal exposures are gone and the DPO has a plan for the next six weeks.
In practice
Do not wait to be perfect. The week's actions cost a few hours and a few hundred dollars and change your legal position immediately; the polish comes over the following month.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.