Is data protection training legally required in Zimbabwe?
Short answer
Two different things. The Data Protection Officer's certification course is a legal requirement under SI 155 of 2024, with the fee fixed in the Regulations. Training your other staff is a legal expectation rather than a named course: it is one of the DPO's statutory functions and part of the "organisational measures" required by section 18 of the Cyber and Data Protection Act.
What the law says
SI 155 states that "every data protection officer shall be required to undergo a certification course approved by the Authority" and fixes the fee at USD 1,250 (citizens) or USD 1,450 (international). Section 14 of SI 155 lists among the DPO's functions to "raise awareness and train staff". Section 18 of the Act requires the controller to take "appropriate technical and organisational measures" to protect personal information, and section 16 of SI 155 adds the development and implementation of organisational policies; untrained staff cannot implement a policy.
Example
A supermarket chain in Harare certifies its DPO (mandatory) and then runs a 60-minute awareness session in each of its eight branches every year, with a signed register (expected). When a till operator photographs a customer's ID card "to check it later" and the photo leaks, the chain can show POTRAZ that the operator had been trained not to do so and had signed the register; the incident is treated as individual misconduct in an otherwise well-run system rather than as evidence of no organisational measures at all.
In practice
Book the DPO certification first because it is compulsory. Then set up a simple annual awareness session for all staff and a short induction module for new hires; both can be delivered by the DPO once certified, or by us.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.