What documents do I need to apply for a POTRAZ data controller licence?
Short answer
To apply for a POTRAZ data controller licence you need Form DP1, your company registration documents, proof of payment of the tier fee, the details of your Data Protection Officer (Form DP2) and a description of what personal data you process, why, and for roughly how many people. POTRAZ has 14 days to approve or reject the application.
What the law says
SI 155 prescribes Form DP1 for licence applications and renewals and Form DP2 for DPO notifications, and requires the applicant to disclose the nature and extent of the personal information it processes. Section 10 of SI 155 then lists what a licensed controller must notify to the Authority: all processing activities, modifications to indirectly collected data, international data transfers and biometric or genetic processing. The Authority must decide within 14 days.
Example
A driving school in Kwekwe prepares its application in one afternoon. The owner prints Form DP1, attaches the CR14 and certificate of incorporation, the proof of payment for USD 50 (Tier 1: 350 learners a year, 8 instructors), the Form DP2 naming the office manager who has booked her DPO certification, and a one-page table: learner records (ID, licence number, medical fitness certificate, payment history, kept for five years), staff files, CCTV at the office, and a WhatsApp Business account for bookings. That table doubles as the record of processing activities the DPO will need later.
In practice
Do the one-page data inventory before you fill in the form; every answer on Form DP1 comes from it. Keep a copy of everything you file, together with the POTRAZ acknowledgement, in your compliance folder. Inspectors ask for the application and the licence together.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.