Does a DPO in Zimbabwe have to pass an exam?
Short answer
Yes. SI 155 of 2024 requires every Data Protection Officer to undergo a certification course approved by POTRAZ, and the approved course ends in a formal examination. Until the candidate passes, they are not certified and your DPO appointment is incomplete.
What the law says
SI 155 provides that "every data protection officer shall be required to undergo a certification course approved by the Authority", and the Second Schedule fixes the training and certification fee (USD 1,250 for citizens, USD 1,450 international). POTRAZ's 2025 DPO Guidelines describe the training and certification framework; the first accredited course, at the Harare Institute of Technology, ran over about two weeks and concluded with a four-hour examination leading to a Data Protection Certificate.
Example
An insurance broker in Harare sends its receptionist on the course because she "has time". She finds the legal and information-security content difficult and fails the examination. The broker has spent USD 1,250, still has no certified DPO, and its Form DP2 names a person POTRAZ will not recognise as qualified. Its competitor sent its internal auditor, who passed comfortably and now runs a credible compliance programme.
In practice
Choose a candidate with a relevant background (law, audit, IT security, data, compliance) and some appetite for regulation. If a candidate fails, they can re-sit; meanwhile consider an interim external certified DPO so that you are not exposed. Keep the certificate with your Form DP2 in the compliance file.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.