Do I have to stop using WhatsApp for customer communication under the CDPA?
Short answer
No, but you must control it. Use a WhatsApp Business account on a company-controlled number, keep customer lists in your own system rather than only in chats, give staff a simple rule that customer data never sits on personal phones or personal accounts, and delete conversations according to your retention rule.
What the law says
Nothing in the Cyber and Data Protection Act names any messaging service; the duties are the general ones. Section 18 requires appropriate security (a personal phone with no lock, no backup and no company control fails that test). Section 15 requires you to tell people why you hold their number and that they can object to marketing free of charge. Section 14 requires you to be able to find, correct and delete a person's data on request. Section 19 makes a lost phone with customer chats a breach notifiable within 24 hours. WhatsApp's servers are abroad, so sections 28 and 29 apply to the transfer as well.
Example
A Bulawayo pharmacy moves from three staff members' personal WhatsApp accounts to a single WhatsApp Business number owned by the pharmacy, on a company phone with a PIN and remote wipe. The profile carries a two-line privacy notice and the DPO's contact. Customer numbers are stored in the pharmacy system, not only in the app; prescription photos are deleted from the chat once dispensed; and when a staff member leaves, nothing leaves with her. The pharmacy still talks to customers exactly as before.
In practice
Uncontrolled WhatsApp on personal phones is the single most common way Zimbabwean SMEs lose control of customer data and the finding most likely to surface in an inspection or a complaint. The fix costs one company phone and one written rule.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.