What is the penalty for not appointing a Data Protection Officer in Zimbabwe?
Short answer
Failing to appoint a Data Protection Officer is a criminal offence under SI 155 of 2024, punishable by a fine of up to level 7 (currently USD 400 on Zimbabwe's standard scale) or imprisonment of up to two years, or both. The practical exposure is larger than the fine.
What the law says
SI 155 provides that a data controller who fails to appoint a DPO as required "shall be liable to a fine not exceeding level 7 or to imprisonment not exceeding two years or to both". Level 7 on the Standard Scale of Fines (SI 14A of 2023) is USD 400, payable in local currency at the interbank rate. In addition, a licence application without a DPO is incomplete, and the absence of a DPO is a licence-condition problem that can affect renewal.
Example
A car-hire company in Harare has a Tier 1 licence but never appointed a DPO. In September 2026 a customer's passport copy is leaked by an employee to a fraud syndicate. Nobody in the company knows about the 24-hour notification duty; the breach is reported eleven days later, after the customer complains. POTRAZ's file now records three failures: no DPO (up to two years), late breach notification under section 19, and inadequate security under section 18 (up to seven years). Appointing and certifying a DPO would have cost USD 1,250.
In practice
Appoint now; the fine is small but the offence is criminal, it is the second thing an inspector checks, and without a DPO your business has no one trained to keep it out of the far more serious offences.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.