You are running a small business. You keep a list of client names and phone numbers in an Excel spreadsheet. You manage a WhatsApp group for customer orders. You have a physical visitor register at your shop reception. You collect names and ID numbers for deliveries.

Congratulations: POTRAZ legally considers you a Data Controller.

Here is what that means. And here is why you need to act before 1 September 2026.

---

The Law You Probably Did Not Know Applied to You

Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024 require any organisation that processes personal data to obtain a Data Controller Licence from POTRAZ. The threshold is low. If you collect or process information from 50 or more individuals, you are required to register.

That means:

• An Excel spreadsheet with client names and phone numbers for 50 people
• A WhatsApp group with more than 50 contacts where you share information or process orders
• A physical visitor register at your reception desk
• A customer list or contractor register with names and contact details
• A database of students, patients, employees, or members

If you hold personal data for 50 or more people, you are a Data Controller. You must be licensed.

---

Who Is Affected?

The list is broad. Under the law, every entity that processes personal data for commercial purposes must comply. This includes:

Churches and religious organisations that maintain membership registers with names, contact details, and personal information.

Schools and universities that store student records, parent contacts, and emergency details.

Clinics, hospitals, and pharmacies that hold patient files, medical histories, and health data.

Retailers that collect customer information for loyalty programmes, deliveries, or orders.

Air BnBs, guest houses, and hospitality businesses that keep guest registers with ID numbers and contact details.

Delivery and courier services that collect names, addresses, and phone numbers for every package. These businesses now require both a Courier Certificate and a Data Protection Compliance Certificate.

Any business that does online purchases, order processing, or promotional lists – you are now legally liable for the data you hold.

If you sell electronic communication devices, Wi-Fi gadgets, or internet access equipment, you also need to comply with POTRAZ regulations.

---

What Is Required of You?

If you are a Data Controller, you must:

1. Obtain a Data Controller Licence from POTRAZ. Licences are issued for 12 months and must be renewed at least three months before expiry.

2. Appoint a Data Protection Officer (DPO). Every Data Controller must appoint a qualified DPO and notify POTRAZ. The officer must complete a certification course that POTRAZ provides in partnership with institutions like the Harare Institute of Technology (HIT).

3. Pay the applicable licence fee. Fees are tiered based on the number of data subjects you handle.

4. Maintain compliance. This includes conducting internal audits, drafting data protection policies, training staff, and responding to data breaches within the required reporting window.

---

The Deadline: 1 September 2026

POTRAZ has moved from awareness to enforcement. Starting 1 September 2026, mandatory inspections and assessments of Data Controllers will begin.

Inspectors will be checking whether organisations are registered, whether they have appointed qualified DPOs, and whether they are complying with the law. The authority has expanded its data protection unit and produced implementation guidelines to strengthen compliance.

If you are not compliant by 1 September, you face fines up to Level 11 (approximately US$1,000), imprisonment for up to seven years, and other legal sanctions.

---

The Intetrix Solutions Approach

We understand that compliance can feel overwhelming – especially if you are running a small business and did not know you were a Data Controller in the first place.

That is why Intetrix Solutions offers outsourced and advisory Data Protection Officer services. We guide organisations from initial compliance assessment through to obtaining the licence and supporting ongoing compliance.

We start with a compliance assessment. We evaluate your current data processing activities against the Cyber and Data Protection Act and Statutory Instrument 155 of 2024. We identify gaps and map a clear path to compliance.

We appoint a qualified DPO on your behalf. Our certified officers handle monitoring, training, policy development, and liaison with POTRAZ. We also manage data breach notifications and reporting.

We manage the licensing process. From notifying POTRAZ of the DPO appointment to submitting the licence application via Form DP1 on the POTRAZ website, we handle it all.

We stay with you. Compliance is not a one-time event. We provide ongoing monitoring, policy updates, and training to keep your organisation compliant year after year.

---

The Clock Is Ticking

If you are a business owner, a church leader, a school administrator, a clinic manager, or anyone who collects personal information from 50 or more people, the law applies to you.

1 September 2026 is less than two weeks away.

Do not wait until the inspectors arrive.

Contact Intetrix Solutions today. Let us help you secure your Data Controller Licence and protect your business.

---