Is not knowing about the CDPA a defence in Zimbabwe?
Short answer
No. Ignorance of the law is not a defence in Zimbabwean criminal law, and the POTRAZ licensing and Data Protection Officer requirements have been gazetted since 13 September 2024 with a six-month transition period and wide publicity. What helps is showing that you acted as soon as you knew.
What the law says
The Criminal Law (Codification and Reform) Act, which the Cyber and Data Protection Act amends, follows the general rule that ignorance of the law does not excuse. SI 155 was published in the Government Gazette in September 2024, POTRAZ issued guidance and public notices through 2025, and the inspection programme was announced in July 2026. The Regulations' transition provisions (six months for licensing, 90 days for DPOs) were the legislature's allowance for businesses to learn and comply.
Example
A Gweru transport operator tells an inspector in 2026 that "nobody told us". The inspector notes that the operator's own bank sent a circular about data controller licences in 2025, that its industry association ran a POTRAZ briefing, and that the operator's accountant raised it at the year-end review. A different operator, equally late, shows that it applied for its licence and appointed a DPO within a fortnight of first hearing about the requirements at that same briefing, and keeps the dated emails. The second operator's position is far stronger even though both were late.
In practice
Stop the clock now: file Forms DP1 and DP2, book the certification, and keep dated evidence of each step. POTRAZ has repeatedly said it prefers compliance to prosecution; give it something to prefer.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.