Are company directors personally liable if there is no POTRAZ licence or DPO?
Short answer
Potentially, yes. Offences under the Cyber and Data Protection Act and SI 155 of 2024 are criminal offences that can be prosecuted against the data controller and, depending on the facts, against the officers who caused or permitted the contravention. Coverage of POTRAZ's 2026 enforcement drive explicitly warns of fines or prison terms for responsible executives.
What the law says
Section 33 of the Act imposes penalties including imprisonment ("not exceeding seven years" for the core breaches; "not exceeding two years" under SI 155 for failing to appoint a DPO). Imprisonment can only be served by a natural person, so where the controller is a company these provisions are applied through the ordinary principles of Zimbabwean criminal law on the liability of directors and officers for offences committed by the company with their knowledge or consent. The Act's cybercrime chapter also creates offences (unlawful acquisition and disclosure of data, sections 163A and following) that can be committed personally.
Example
The directors of a debt collection company in Harare receive written advice from their lawyer in 2025 that they need a POTRAZ licence and a DPO, and decide to "wait and see". In 2026 the company is inspected, found unlicensed, and found to have disclosed debtors' details to employers. The written advice, and the minuted decision to ignore it, are the facts a prosecutor would use to argue that the directors permitted the contraventions.
In practice
Put CDPA compliance on the board agenda: approve the licence and DPO budget, receive the DPO's quarterly report, minute decisions. Directors who can show they governed the issue are in a different position from directors who ignored it.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.