Can POTRAZ refuse, suspend or revoke my data controller licence?
Short answer
Yes. POTRAZ can reject a licence application, and it can suspend, revoke or refuse to renew a data controller licence where you breach the Cyber and Data Protection Act, SI 155 of 2024 or your licence conditions. Any POTRAZ decision can be appealed to the Administrative Court under section 34 of the Act.
What the law says
SI 155 requires the Authority to approve or reject an application within 14 days and conditions the licence on continued compliance; a licence granted subject to conditions can be withdrawn when those conditions are broken. Section 6 of the Act gives POTRAZ the function of ensuring lawful processing and investigating complaints. Section 34 provides that "any person aggrieved by the decision of the Authority may appeal to the Administrative Court". An appeal does not suspend your obligations under the Act in the meantime.
Example
A debt collection agency in Harare has its Tier 2 licence suspended after POTRAZ upholds complaints that it obtained debtor lists from a mobile operator without any lawful basis and disclosed debts to debtors' employers. While suspended it cannot lawfully process personal information at all, which for a debt collector means it cannot trade. It appeals to the Administrative Court, but must stop the unlawful disclosures immediately and can only resume processing once the suspension is lifted.
In practice
Treat licence conditions seriously: correct tier, accurate description of processing, a certified DPO, timely notifications. If POTRAZ writes to you about a possible breach, respond fully and on time; most suspensions follow silence or evasion rather than a first mistake. If you receive an adverse decision, take legal advice quickly because appeal time limits are short.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.