Which businesses in Zimbabwe do not need a Data Protection Officer?
Short answer
Only organisations that are not data controllers at all: purely personal or household use, and the section 8 SI 155 categories (journalistic, historical and archival processing, with law enforcement handled separately). Every trading business, NGO, church, school and clinic that holds personal information is a data controller and must appoint a Data Protection Officer.
What the law says
SI 155 attaches the DPO duty to "every data controller". The only processing outside the controller regime is the section 8 exempt processing, and even journalists and law-enforcement bodies must register with POTRAZ and follow the principles. There is no threshold of staff, turnover or records below which the DPO requirement falls away. The only grey area is the sub-50 data subject business, which sits below the licence tiers (Q3); the Regulations do not expressly exempt it from the DPO duty either, and the safe course is to have a named, informed person.
Example
A three-person graphic design studio in Harare with 20 clients and no staff files beyond the founders is below the tiers and, on a strict reading, not yet within the licensing scheme. The founders still designate one of themselves as the contact for data matters and read the Act, because the moment they win a corporate client with 200 employee headshots to process they will be a Tier 1 controller and will need a certified DPO and a licence.
In practice
Do not spend time looking for an exemption that does not exist for trading businesses. Spend it choosing the right DPO model (internal, external or shared) and getting the certification booked.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.