Cyber and Data Protection Act [Chapter 12:07] (Zimbabwe) compliance software
Zimbabwe's Cyber and Data Protection Act with SI 155 of 2024 on licensing data controllers and appointing data protection officers: 84 controls across 12 domains, ready for the POTRAZ compliance inspections that began on 1 September 2026.
- RegulatorPOTRAZ (Data Protection Authority)
- InstrumentsCyber and Data Protection Act [Chapter 12:07], Act 5 of 2021; SI 155 of 2024
- Structure12 domains · 84 controls
- LicenceUS$50 to US$2,500 by tier, valid 12 months
- NotificationsBreach to POTRAZ within 24 hours · data subjects within 72 hours · inspections from 1 September 2026
What Zimbabwe CDPA requires
Who it applies to
- Data controllers processing the personal information of 50 or more people, which need a POTRAZ licence renewed every 12 months
- Public bodies, which the Act treats as data controllers where they determine the purpose and means of processing
- Data processors, who may process data only as instructed by the controller (section 17)
- Sectors named for priority inspection from 1 September 2026: financial institutions, insurers, healthcare providers, local authorities, schools and mining companies
The Cyber and Data Protection Act [Chapter 12:07], Act 5 of 2021, designates the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the Data Protection Authority. The Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, SI 155 of 2024, took effect on 13 September 2024 and turned the Act's duties into a licensing regime: a data controller licence renewed every 12 months, and a data protection officer who has completed a certification course approved by the Authority. GRCLens carries 84 assessable controls across 12 domains.
Licence fees run from US$50 to US$2,500 by tier, and POTRAZ says any organisation processing the personal information of 50 or more people generally needs one. The licensing deadline was 12 March 2025, and existing controllers had to appoint and notify a data protection officer within 90 days of the Regulations taking effect. A security breach must be notified to POTRAZ within 24 hours under section 19 of the Act, and affected data subjects within 72 hours under the Regulations. Offences under the Regulations carry fines of up to level 11 or imprisonment of up to seven years.
POTRAZ's Regulatory Notice 2 of 2026 started mandatory, risk-based compliance inspections on 1 September 2026, prioritising financial institutions, insurers, healthcare providers, local authorities, schools and mining companies. Inspections look at licensing, security measures and data governance, so the evidence has to exist before the inspector arrives. The Act also treats health, genetic and biometric data as sensitive data with their own processing rules, and it moved computer crime offences into the Criminal Law (Codification and Reform) Act.
How GRCLens supports Zimbabwe CDPA
Zimbabwe CDPA runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Licence and officer as evidence
The data controller licence, its tier and renewal date, and the data protection officer's appointment, notification to POTRAZ and certification are evidenced controls, so a lapsed licence or an uncertified officer shows as a gap.
The 24-hour and 72-hour clocks
The notice to POTRAZ within 24 hours and the notice to affected data subjects within 72 hours are separate controls, with the incident record that shows when each clock started.
Inspection-ready evidence
Each control lists the deliverables an inspector can ask to see, so preparing for a POTRAZ inspection means reviewing a record rather than building one.
Every control cites its source
Controls cite the section of the Act or the regulation in SI 155 of 2024 they come from, including the rules for sensitive, genetic, biometric and health data in sections 11 and 12.
Beside the Reserve Bank guideline and ISO/IEC 27001
A bank or payment provider assesses CDPA security duties on the same control model as the Reserve Bank of Zimbabwe's cybersecurity guideline and ISO/IEC 27001, so evidence is collected once.
Zimbabwe CDPA frequently asked questions
Who needs a data controller licence from POTRAZ?
POTRAZ says any organisation that processes the personal information of 50 or more people generally needs a licence, with narrow exceptions such as purely personal or household use. Licences under SI 155 of 2024 are valid for 12 months.
How much does a POTRAZ data controller licence cost?
Between US$50 and US$2,500, depending on the licence tier, under SI 155 of 2024. Licences run for 12 months and must be renewed, with renewal applied for ahead of expiry.
How fast must a data breach be reported in Zimbabwe?
To POTRAZ within 24 hours of any security breach affecting the data, under section 19 of the Cyber and Data Protection Act, and to affected data subjects within 72 hours under SI 155 of 2024.
When must a data protection officer be appointed?
SI 155 of 2024 required existing data controllers to appoint a data protection officer and notify POTRAZ within 90 days of the Regulations taking effect on 13 September 2024. The officer must complete a certification course approved by the Authority.
When do POTRAZ compliance inspections start?
On 1 September 2026, under Regulatory Notice 2 of 2026. Inspections are risk-based and prioritise financial institutions, insurers, healthcare providers, local authorities, schools and mining companies.
One platform, many obligations
See all supported frameworks → Every framework that applies in Zimbabwe →
Talk to us about Zimbabwe CDPA
Security Solution Consultants provides Zimbabwe data protection and POTRAZ compliance advisory alongside the platform, so you can combine tooling with hands-on expertise.