How likely is a POTRAZ inspection for a small business in Zimbabwe?
Short answer
More likely than a year ago. POTRAZ's inspection programme, running since 1 September 2026, is risk-based and starts with nine priority sectors, but three other routes reach small businesses every day: a customer or employee complaint to POTRAZ, a data breach you must report within 24 hours, and a bank or large client asking for your data controller licence number.
What the law says
Section 6 of the Act gives POTRAZ the functions of ensuring lawful processing and investigating complaints, and SI 155 gives it the licensing powers that inspections enforce. POTRAZ's July 2026 announcement listed the priority categories: financial institutions, insurers, local authorities, healthcare providers, mining enterprises, religious organisations, educational institutions and professional bodies, government ministries and agencies, and NGOs / private voluntary organisations. Nothing in the announcement limits inspections to those sectors; they are the starting order.
Example
A small hardware store in Kwekwe is not in any priority sector and might never be selected for a routine inspection. But in October 2026 a former employee, dismissed after a stock dispute, emails POTRAZ that the store keeps customers' ID copies in an open box and has no licence. POTRAZ writes to the store. The store's exposure came not from a sector list but from a complaint, which any of its 2,000 customers or 15 current and former staff could have made.
In practice
Do not calculate the odds of a routine inspection; calculate the odds that in the next three years one customer complains, one laptop is stolen or one bank asks for your licence. Those odds are high, and each event turns into an inspection of a business that is either ready or not.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.