How do I prove to POTRAZ that data protection training took place?
Short answer
Keep a training file containing the Data Protection Officer's POTRAZ certificate and CPD certificates, a one-page annual training plan, attendance registers with signatures or online completion logs, the slides or course outline, and quiz results. That file is what a POTRAZ inspector will ask for when checking your organisational measures.
What the law says
Section 16 of SI 155 requires the controller to implement organisational policies and to regularly test the effectiveness of its security measures; section 24 of the Act requires the controller to be able to demonstrate accountability. Neither prescribes a format, so the standard is simply whether you can show, with dated records, that training happened and had an effect.
Example
During a September 2026 inspection of an insurance company in Harare, the inspector asks how staff are made aware of their obligations. The DPO opens the training module of the compliance software: the 2025 and 2026 awareness sessions with 210 and 224 completions, the quiz average, the induction module for 18 new hires, her own certificate and two CPD certificates, and the plan for 2027. The question is answered in two minutes and the inspector moves on.
In practice
Decide where the evidence lives (a folder, a shared drive, or our compliance software's Training module), and file each item the day it is produced. Evidence assembled after an inspection letter arrives is always less convincing than evidence filed as you go.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.