On 1 September 2026, POTRAZ began mandatory data protection inspections under Zimbabwe’s Cyber and Data Protection Act. If your business holds the personal details of 50 or more people, you are a data controller; you need a licence, and the inspections have already started.
Most of the coverage has been aimed at banks and hospitals. This guide is written for the rest of us: the marketing consultant with a mailing list, the retailer with a WhatsApp broadcast group, the school with a parent database, the salon with a booking book.
Who this applies to
Any organisation that processes the personal information of 50 or more people needs a data controller licence. There is no exemption for being small, and no exemption for being a sole trader.
The categories POTRAZ has named as its inspection priorities are banks, insurance companies, hospitals, local authorities, schools and universities, churches, mining companies, professional bodies, NGOs and government ministries. Inspections are risk-based and work down from there, which means smaller organisations are later in the queue, not outside it.
What counts as personal data
This is where most businesses underestimate their exposure. All of the following are personal data if they identify a person:
- An email mailing list
- A WhatsApp broadcast list
- Any lead capture or enquiry form
- A customer or client database
- The delivery book at the counter
- A spreadsheet of names and phone numbers on somebody’s laptop
- Employee records
You do not have to be a technology company to be a data controller. You only have to hold details about people, and most businesses hold far more than they realise, in more places than they can account for.
What a licence costs
| Database size | Annual licence fee |
|---|---|
| 50 to 1,000 records | US$ 50 |
| 1,001 to 100,000 records | US$ 300, plus a US$ 30 application fee |
| Above 100,000 records | US$ 500 to US$ 2,500 |
On top of the licence, organisations are required to appoint a certified Data Protection Officer, which costs US$ 1,250 plus a US$ 30 application fee. For a small organisation, first year compliance can therefore exceed US$ 1,300.
That figure has drawn criticism. Analysts have warned that compliance costs will be passed on to consumers through higher prices, and that the burden falls hardest on the smallest organisations, who hold the least data and can least afford the officer requirement.
The two clocks you need to know about
If a data breach happens, two deadlines start running:
- 24 hours to report the breach to POTRAZ
- 72 hours to notify the people whose details were exposed, where the breach presents a real risk to them
Twenty-four hours is not long enough to work out what to do from a standing start. It is long enough to follow a plan you already wrote down.
What happens if you do not comply
Processing personal data without the required licence carries a level 11 fine and, for those responsible, imprisonment of up to seven years. The liability sits with the chief executive or the responsible officer, not with an abstract company.
What to do this week
- Count. Add up how many people’s details you hold across every list, form, spreadsheet and book. If the number is 50 or more, you are in scope.
- Find every copy. Work out who else has a copy of your customer data. Old laptops, a former employee’s personal email, a WhatsApp export somebody made once. Account for each one.
- Check your consent wording. What did you tell people when you collected their details, and does what you do with the data still match it?
- Write the breach plan. One page, naming who does what in the first 24 hours. Do it before you need it.
- Confirm your status with POTRAZ. If you are not sure whether you are licensed or need to be, ask rather than assume.
Where to check your position
POTRAZ publishes licensing guidelines and can confirm whether your organisation needs to register. Organisations uncertain about their obligations can contact POTRAZ directly on 0242-333032, extension 1129.
This article is a plain-language summary for business owners and marketers. It is not legal advice. If you hold sensitive data, or you are unsure whether an exemption applies to you, confirm your position with POTRAZ or a qualified legal practitioner before acting.
The wider point for marketers
For years the advice in digital marketing has been to build your list, because a list is the one audience no platform can take away from you. That advice still holds. What has changed is that the list now comes with obligations attached.
Treat it the way you would treat any other regulated asset in the business. Know where it is. Know who can reach it. Know what you promised the people on it. Doing that costs you a morning. Not doing it is now written into law.
Sources
- POTRAZ starts data protection inspections on 1 September, Techzim
- POTRAZ data licence fees slammed as costly burden on businesses and consumers, CITE
- Bill Watch 27-2026: POTRAZ inspections to ensure compliance with the Cyber and Data Protection Act, Veritas
Get the weekly brief
Every week I send a short brief to marketing and social media professionals in Zimbabwe covering the changes that actually affect how you work, with one practical action to take from each. Subscribe using the form on this page.
If you want to build the full skill set rather than keep up week by week, the Professional Diploma in Digital Marketing is studied around your job and recognised by employers well beyond Zimbabwe.
Written by Nikolina Kobali, Digital Marketing Institute representative for Zimbabwe.
