What is the right order: POTRAZ licence first, or Data Protection Officer first?
Short answer
Both are required, but a sensible order exists. First appoint the Data Protection Officer and file Form DP2, because everything else is their job. Second apply for the POTRAZ data controller licence on Form DP1, because processing unlicensed is the most serious offence. Third build the evidence: processing record, privacy notice, processor contracts, security basics and the breach plan.
What the law says
SI 155 requires both the licence and the DPO, and the licence application needs the DPO's details, which is why the DPO comes first in practice. The penalties point the same way: no licence is level 11 or seven years; no DPO is level 7 or two years; but the DPO is the person who will keep you out of every other offence in section 33 of the Act (sections 11, 13, 18, 24, 28) by building the processing record, contracts and breach plan.
Example
A Tier 1 cleaning company in Harare with 80 staff and 60 corporate clients follows the order. Week 1: the HR manager is appointed DPO by letter and enrolled on the certification course; Form DP2 is filed. Week 2: Form DP1 and USD 50 are filed with the processing record she drafted from the payroll and client lists. Weeks 3 to 6: privacy notice for staff and client contacts, processing annexes for the payroll bureau and the SMS provider, a company phone for the WhatsApp Business account, laptop encryption, and a one-page breach plan with a pre-filled Form DP3. Week 7: a 60-minute staff session with a register.
In practice
Do not wait to be "perfect" before applying for the licence; file with what you have and improve the evidence over the following weeks. The two criminal exposures are removed in two weeks; the rest follows.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.