What happens if I forget to renew my POTRAZ data controller licence?
Short answer
If your POTRAZ data controller licence expires, you are processing personal information without a licence, which is the same criminal offence as never having registered: a fine of up to level 11 or up to seven years' imprisonment, or both. Renewal applications are due at least three months before expiry.
What the law says
SI 155 provides that the licence is valid for 12 months and that renewal must be applied for at least three months before expiry. The Regulations make processing without a valid licence an offence, and they do not provide a grace period after expiry. POTRAZ may also treat a late renewal as a breach of licence conditions when deciding whether to renew at all.
Example
A private clinic in Harare's Belvedere suburb obtained its Tier 2 licence in March 2026 but the administrator who handled it left in July and nobody picked up the file. In April 2027 a POTRAZ inspector, visiting because healthcare is a priority sector, finds that the licence lapsed in March and that 4,000 patient records (sensitive health data) have been processed unlicensed for a month. What would have been a routine USD 300 renewal is now an offence and a finding on the inspection report.
In practice
Put the renewal date in at least two people's calendars and in your board or management meeting schedule. If you realise the licence has lapsed, file the renewal immediately with a short covering letter explaining the lapse and the steps taken; do not wait to be found.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.