Can you go to prison for not registering with POTRAZ as a data controller?
Short answer
The law allows it. Processing personal information without a POTRAZ data controller licence carries imprisonment of up to seven years under SI 155 of 2024, and failing to appoint a Data Protection Officer up to two years, in each case "or both" with the fine. Whether a court imposes prison on a first, minor, cooperative offender is a matter of judicial discretion, but directors should not plan around leniency.
What the law says
SI 155 provides that a person who continues to process personal data without a licence after the transition period is liable to "a fine not exceeding level 11 or to imprisonment for a period not exceeding seven years or to both". Section 33 of the Act uses the same formula for the core substantive breaches. These are the same penalty levels the Act uses for serious cybercrimes, which signals how seriously the legislature treats unlicensed processing.
Example
The owner of a Harare recruitment agency holding 25,000 CVs, ID copies and reference checks (some containing criminal-record and health information) is inspected in 2026 with no licence and no DPO. Her lawyer advises that a prosecutor could charge the company and, on the facts, her personally; that cooperation, immediate licensing and a credible remediation plan are her best mitigation; and that the outcome would have been avoided entirely by a USD 330 licence and a USD 1,250 certification.
In practice
The point of a criminal penalty is that this is not civil paperwork to be settled later. Remove the exposure: file Forms DP1 and DP2 now, keep the evidence, and cooperate fully if POTRAZ writes.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.