Does appointing a DPO in Zimbabwe mean hiring a full-time employee?
Short answer
No. Appointing a Data Protection Officer in Zimbabwe does not require a full-time hire. SI 155 of 2024 requires you to appoint a DPO with the right skills, certification and authority; it does not require a dedicated post. Most SMEs assign the role to an existing manager or contract an external DPO.
What the law says
SI 155 section 13 describes the DPO by "skill, qualifications, or experience", not by employment status or hours. Section 14 lists functions (monitoring, training, audits, handling requests, liaising with POTRAZ) that scale with the size and risk of the organisation. POTRAZ's DPO Guidelines recognise that the DPO may be a staff member or engaged under a service contract, and require that the DPO has the time, resources and access to top management needed to perform the functions.
Example
A 25-person accounting firm in Harare designates its audit manager as DPO. After certification she spends roughly half a day a month on the role: reviewing the request log, checking that new client engagement letters carry the processing clause, and updating the breach plan. A 300-employee hospital, by contrast, gives its DPO a substantial part of a full-time role because of the volume of health data, the number of processors and the frequency of patient requests.
In practice
Match the time allocation to your risk: a few hours a month for a Tier 1 business with ordinary data, more for anything involving health, finance, children or thousands of records. Write the allocation into the appointment letter so that POTRAZ can see the role is real, and review it annually.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.