If you run a business in Zimbabwe, here is a question you need to answer: Are you compliant with the Cyber and Data Protection Act?
If you collect IDs, phone numbers, email addresses, medical records, or even emergency contact details from employees or customers, the law applies to you. And the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is now enforcing it with mandatory inspections starting 1 September 2026.
Let us break down what this means for your business and how Intetrix Solutions can help you stay on the right side of the law.
What Is POTRAZ and Why Does It Matter to Your Business?
POTRAZ is the designated Data Protection Authority in Zimbabwe under the Cyber and Data Protection Act [Chapter 12:07]. Its job is to regulate how personal information is processed, stored, and protected.
Under Statutory Instrument 155 of 2024, all entities that process personal data were required to obtain a Data Controller Licence by 12 March 2025.
That deadline has passed. And POTRAZ has made it clear that non‑compliance is no longer tolerated. Dr Gift Machengete, POTRAZ Director‑General, recently stated: “POTRAZ has noted with concern that some organisations continue to process personal data without the requisite licence, despite the lapse of the March 2025 compliance deadline.”
The message is unmistakable: enforcement is here.
Who Needs a Data Controller Licence?
If your organisation collects or processes personal information from 50 or more individuals, you are required to register.
Personal data includes names, addresses, phone numbers, email addresses, national ID numbers, employment and financial records, medical and health information, biometric data such as fingerprints or facial recognition, and even race, ethnicity, or religious beliefs.
Which organisations must comply? Schools and universities holding student records. Churches and religious organisations with membership registers. Clinics, hospitals, and pharmacies managing patient files. Banks, insurance companies, and microfinance institutions. Supermarkets with customer loyalty programmes. Employers maintaining employee records. NGOs and PVOs. And any business that processes customer data.
If this sounds like your organisation, you need a licence. And if you don’t have one, you are currently in violation of the law.
What Happens If You Don’t Comply?
POTRAZ has moved from raising awareness to active enforcement. Starting 1 September 2026, mandatory inspections and assessments will begin.
The penalties are severe: fines up to Level 11, which is approximately USD 1,000, imprisonment for up to seven years, and other legal sanctions. POTRAZ is also working on introducing civil sanctions for non‑compliant entities.
The message is clear: the season of silent tolerance is over.
The Data Protection Officer Requirement
Beyond the licence, every data controller must appoint a Data Protection Officer (DPO).
A DPO’s responsibilities are wide‑ranging: monitoring compliance with the Cyber and Data Protection Act, conducting internal audits and data protection impact assessments, training staff on data protection policies, acting as the point of contact for POTRAZ and data subjects, overseeing data breach notifications and reporting, and drafting and implementing data protection policies.
DPOs must have specific qualifications in law, data science, information systems audit, or equivalent fields, and must complete certification training. As of May 2026, Zimbabwe has trained just over 1,000 certified DPOs. But many organisations still have gaps in appointing qualified DPOs.
The Intetrix Solutions Advantage: Outsourced & Advisory DPO Services
This is where Intetrix Solutions comes in.
We provide outsourced and advisory Data Protection Officer services, guiding organisations from initial compliance assessment through to obtaining a Data Controller Licence from POTRAZ – and supporting ongoing compliance after that.
We start with a compliance assessment, evaluating your current data processing activities against the requirements of the Cyber and Data Protection Act and Statutory Instrument 155 of 2024. We identify gaps and map a clear path to compliance.
Then we appoint a qualified, certified DPO to act on your behalf. Our DPOs handle monitoring, internal audits, impact assessments, staff training, policy development, and liaison with POTRAZ. They also oversee data breach notifications and reporting.
We manage the entire licensing process: appointing a qualified DPO certified through Harare Institute of Technology, notifying POTRAZ of the DPO appointment using Form DP2, applying for the licence via Form DP1 on the POTRAZ website, and ensuring payment of the applicable fees, which range from USD 50 to USD 2,500 depending on tier.
Compliance is not a one‑time event. Licences are valid for 12 months and must be renewed three months before expiry. We provide ongoing monitoring, policy updates, and staff training to keep your organisation compliant year after year.
We also help you respond to data breaches within the required 24‑hour reporting window and notify affected data subjects within 72 hours.
Why Intetrix Solutions?
We understand the law. Our team knows the Cyber and Data Protection Act, Statutory Instrument 155 of 2024, and POTRAZ’s implementation guidelines inside out.
We are vendor‑neutral. We do not sell boxes. We sell roadmaps. We recommend what fits your organisation, not what we have in stock.
We are practical. Compliance must be operational, not theoretical. We translate legal requirements into practical, implementable steps that fit your business.
And we stay with you. We do not disappear after we hand over the licence. We provide ongoing support, training, and monitoring to keep you compliant as regulations evolve.
The Clock Is Ticking
POTRAZ inspections begin 1 September 2026. If your organisation processes personal data and does not have a Data Controller Licence or a qualified DPO, you are at risk.
Do not wait until the inspectors arrive.
Contact Intetrix Solutions today. Let us help you navigate the compliance landscape, secure your licence, and protect your business from penalties, fines, and reputational damage.
