Do I need a POTRAZ licence to hold customer data in Zimbabwe?
Short answer
Yes. You need a POTRAZ data controller licence to hold customer or employee data in Zimbabwe. SI 155 of 2024 requires every data controller to be licensed, and since 12 March 2025 processing personal information without a licence is a criminal offence.
What the law says
SI 155 provides that no person shall act as a data controller without a licence issued by the Authority, that applications are made on Form DP1 with the prescribed fee, and that the Authority shall approve or reject an application within 14 days. Section 3 of the Act itself now defines a data controller as a person "who is licensable by the Authority". Processing after the six-month transition period without a licence attracts a fine of up to level 11 or up to seven years' imprisonment, or both.
Example
A pharmacy in Mutare holds prescription records for 3,000 patients (health data, sensitive under section 11), a loyalty list, and 12 staff files. It is a Tier 2 controller. Its owner assumed the Medicines Control Authority registration covered "all that". It does not; the POTRAZ licence is a separate requirement under a separate law, and healthcare providers are among POTRAZ's priority inspection sectors.
In practice
Download Form DP1 from the POTRAZ website, count your data subjects to identify your tier, pay the fee (USD 50 for Tier 1; USD 300 plus USD 30 for Tier 2), attach your company documents and your DPO's Form DP2, and file. Diarise the 12-month expiry and the renewal deadline three months before it.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.