How long does it take to become CDPA-compliant in Zimbabwe from zero?
Short answer
Most small businesses can be inspection-ready in six to eight weeks. POTRAZ licence and Data Protection Officer notification take two to four weeks (POTRAZ decides on the licence within 14 days); DPO certification about two weeks of course plus the examination; basic documents a week of focused DPO work; security basics a few days with your IT provider.
What the law says
SI 155 gives POTRAZ 14 days to approve or reject a licence application. The certification course length is set by the approved provider (about two weeks at the first accredited institution). The documents map to sections 15 and 16 of the Act (privacy notice), section 10 of SI 155 (processing record, processor agreements), section 18 and SI 155 section 16 (security policy) and section 19 (breach plan). None of these has a statutory preparation period; the constraint is your own calendar.
Example
A Tier 2 wholesaler in Bulawayo starts on 1 October. By 7 October the finance manager is appointed DPO and enrolled; Forms DP1 and DP2 are filed on 10 October; the licence arrives on 22 October. The certification course runs 13 to 24 October, examination 27 October. Processing record and privacy notice are done by 31 October; processor annexes are out to six vendors by 5 November and four are back by 20 November; laptops are encrypted and two-factor authentication switched on by 10 November; the breach plan is agreed on 14 November; staff sessions run 17 to 21 November. On 25 November the DPO assembles the inspection binder. Eight weeks.
In practice
The first two weeks (appoint the DPO, apply for the licence) remove the two criminal exposures; the remaining weeks build the evidence that turns an inspection into a conversation. Start the clock today.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.