Does the Data Protection Officer have to be independent from management?
Short answer
The Data Protection Officer should be able to do the job without being penalised for giving unwelcome advice and should report directly to top management. That does not put the DPO above the board: you receive the advice, decide, record the decision and remain responsible to POTRAZ.
What the law says
Section 14 of SI 155 makes the DPO responsible for monitoring the controller's compliance and conducting audits, functions that only make sense if the DPO can reach conclusions management may not like. POTRAZ's 2025 DPO Guidelines require that the DPO reports to the highest level of management, is not dismissed or penalised for performing the functions, and avoids conflicts of interest with other roles. Any termination of a DPO must be notified to POTRAZ within 14 days, so a dismissal after unwelcome advice will be visible to the regulator.
Example
The DPO of a Harare microfinance company advises that using borrowers' phone contact lists (scraped by the loan app) to pressure defaulters is unlawful processing of third parties' data without any basis under section 10. The chief executive disagrees and, a month later, terminates her contract. POTRAZ receives the termination notice and, soon after, complaints from borrowers about calls to their relatives. The sequence of events tells its own story. Had the company minuted her advice, stopped the practice and kept her, the same complaints would have found a compliant business.
In practice
Give the DPO a direct line to the owner or board, a standing slot at management meetings, and a written undertaking that they will not be penalised for their advice. Disagreements are legitimate; record them, decide, and be ready to defend the decision to POTRAZ.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.