Who is responsible under the CDPA when agents or sales reps collect customer data for my business?
Short answer
You are. If agents or commission sales people collect customer information for your business and you decide what happens to it, you are the data controller under the Cyber and Data Protection Act and they act on your behalf. Their mistakes are your data breaches, reportable to POTRAZ within 24 hours.
What the law says
The controller is the person who determines the purpose and means of processing (section 3), which is you, not the agent. Section 18 requires you to ensure that anyone acting under your authority processes personal information only on your instructions and under appropriate security. Section 15 requires the person collecting the data to inform the data subject of the controller's identity and purposes; if your agent collects it, that notice must still be given in your name.
Example
A funeral assurance company uses 200 commission agents across Mashonaland to sign up policyholders on paper forms and by taking photos of ID cards with their own phones. One agent's phone, containing 400 ID photos, is stolen in a bar in Kadoma; another sells a list of policyholders to a rival. Both incidents are breaches of the company's data, notifiable by the company, and both would have been avoided by a company-issued app and clear rules.
In practice
Give agents a one-page rule sheet (what to collect, how to store it, where to send it, what never to do), a privacy notice to hand or read to customers, and a signed confidentiality undertaking. Where possible, issue a company app or device instead of allowing personal phones. Include agents in your annual awareness training and record their attendance.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.