DPO training and data protection training in Zimbabwe
Eight questions on training. Whether data protection training is legally required, what frontline staff need, the cost and duration of DPO certification, which institutions POTRAZ approves, online delivery, and how to evidence training to an inspector.
Two different training obligations sit in the framework and they are often confused. The Data Protection Officer must hold an Authority-certified qualification, which is a formal course and an exam. Separately, the people who actually handle personal data every day have to be trained and you have to be able to show an inspector that it happened.
Is data protection training legally required in Zimbabwe?
Two different things. The Data Protection Officer's certification course is a legal requirement under SI 155 of 2024, with the fee fixed in the Regulations. Training your other staff is a legal expectation rather than a named course: it is one of the DPO's statutory functions and part of the "organisational measures" required by section 18 of the Cyber and Data Protection Act.
SI 155 states that "every data protection officer shall be required to undergo a certification course approved by the Authority" and fixes the fee at USD 1,250 (citizens) or USD 1,450 (international). Section 14 of SI 155 lists among the DPO's functions to "raise awareness and train staff". Section 18 of the Act requires the controller to…
Do frontline staff need data protection training under Zimbabwe's CDPA?
Yes, briefly. Cashiers, receptionists, drivers, tellers and sales agents handle personal information every day, and most data breaches in Zimbabwe are their mistakes rather than hackers' attacks. A 60- to 90-minute awareness session once a year, with a signed attendance register, is the cheapest security measure you can buy and the first evidence a POTRAZ inspector accepts.
Section 18 of the Act requires "appropriate technical and organisational measures", and section 33 penalises anyone acting under the controller's authority who processes personal information otherwise than as instructed (fine up to level 7 or two years). To instruct staff you must train them. Section 14 of SI 155 makes staff training a DP…
How much does DPO certification cost in Zimbabwe and how long does it take?
DPO certification in Zimbabwe costs USD 1,250 per person for Zimbabwean citizens and USD 1,450 for international candidates, fixed in the Second Schedule of SI 155 of 2024. The POTRAZ-approved course has typically run over about two weeks and ends in a formal examination of around four hours.
The Second Schedule to SI 155 sets "DPO training and certification fees" at USD 1,250 per person for Zimbabwean citizens and USD 1,450 per person for international candidates. SI 155 requires the course to be "approved by the Authority". POTRAZ's 2025 Guidelines on DPO training and certification describe the framework; the first accredite…
Which institutions are approved by POTRAZ for DPO training in Zimbabwe?
Only institutions approved by POTRAZ may deliver the Data Protection Officer certification required by SI 155 of 2024. The Harare Institute of Technology (HIT) was the first accredited provider, and POTRAZ has been accrediting further institutions. A general privacy course or a foreign GDPR certificate does not satisfy the requirement.
SI 155 requires a "certification course approved by the Authority". Section 6 of the Act gives POTRAZ its regulatory functions, and POTRAZ's 2025 DPO Guidelines set out the training and certification framework under which institutions are accredited. Staff awareness training and management briefings are not subject to approval; only the D…
Can DPO training and data protection training be done online in Zimbabwe?
Often, yes. SI 155 of 2024 fixes the outcome, a POTRAZ-approved course and a passed examination, not the delivery method, so approved providers set their own format and examinations are commonly invigilated. Staff awareness and management sessions have no format rules and can be delivered entirely online.
SI 155 says only that the DPO must "undergo a certification course approved by the Authority"; the format is for the approved provider and POTRAZ to determine under the 2025 Guidelines. For staff training, section 18 of the Act and section 16 of SI 155 require organisational measures and evidence that they are effective; a completion log …
What CDPA training does Business Science Institute offer, and which parts are compulsory?
Business Science Institute offers three tracks. The DPO track prepares your named Data Protection Officer for the certification examination and for the day-to-day role; the owner / director track is a short briefing on the decisions that belong to management; the staff awareness track is the annual 60- to 90-minute session for all employees. Only the DPO certification is compulsory by law.
SI 155 makes the DPO certification mandatory and subject to POTRAZ approval, so ask us for the current status of that approval before enrolling, exactly as you should ask any provider. Owner and staff training are not prescribed courses; they are how a controller discharges the organisational-measures duty in section 18 of the Act and sec…
What happens if I skip data protection training in Zimbabwe?
Without POTRAZ-approved certification your Data Protection Officer appointment is incomplete, which puts you back in the "no DPO" position (fine up to level 7 or up to two years). Without staff awareness you will struggle to show "appropriate organisational measures" if a breach happens, and breaching the security duty carries the top penalty (level 11 or up to seven years).
SI 155 requires DPO certification and penalises the absence of a DPO. Section 18 of the Act requires technical and organisational measures, and section 33 penalises a controller who contravenes section 18 with "a fine not exceeding level 11 or imprisonment for a period not exceeding seven years or both". Section 16 of SI 155 requires or…
How do I prove to POTRAZ that data protection training took place?
Keep a training file containing the Data Protection Officer's POTRAZ certificate and CPD certificates, a one-page annual training plan, attendance registers with signatures or online completion logs, the slides or course outline, and quiz results. That file is what a POTRAZ inspector will ask for when checking your organisational measures.
Section 16 of SI 155 requires the controller to implement organisational policies and to regularly test the effectiveness of its security measures; section 24 of the Act requires the controller to be able to demonstrate accountability. Neither prescribes a format, so the standard is simply whether you can show, with dated records, that tr…
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.