POTRAZ data controller licence: do I need one and what does it cost?
Fifteen questions on licensing. Tiers and fees under SI 155 of 2024, Form DP1, what documents you need, renewals, tier upgrades mid-year, group companies, late registration and whether POTRAZ can refuse or revoke a licence.
SI 155 of 2024 made the data controller licence compulsory for every controller holding data on 50 or more people. The fee is modest and the tiers are fixed in the Second Schedule; what catches organisations out is the paperwork behind the application and the fact that the licence has to be renewed every twelve months, at least three months before it expires.
Do I need a POTRAZ licence to hold customer data in Zimbabwe?
Yes. You need a POTRAZ data controller licence to hold customer or employee data in Zimbabwe. SI 155 of 2024 requires every data controller to be licensed, and since 12 March 2025 processing personal information without a licence is a criminal offence.
SI 155 provides that no person shall act as a data controller without a licence issued by the Authority, that applications are made on Form DP1 with the prescribed fee, and that the Authority shall approve or reject an application within 14 days. Section 3 of the Act itself now defines a data controller as a person "who is licensable by t…
How much does a POTRAZ data controller licence cost in Zimbabwe?
A POTRAZ data controller licence costs between USD 50 and USD 2,500 a year, depending on how many people's data you hold, plus a USD 30 application fee for Tiers 2 to 4. The fees are fixed in the Second Schedule of SI 155 of 2024.
The Second Schedule reads, in substance: application fee for Tier 2, 3 or 4 licences, USD 30; Tier 1 licence, USD 50; Tier 2 licence, USD 300; Tier 3 licence, USD 500; Tier 4 licence, USD 2,500. The First Schedule defines the tiers: Tier 1, 50 to 1,000 data subjects; Tier 2, 1,001 to 100,000; Tier 3, 100,001 to 500,000; Tier 4, more than …
Is the POTRAZ data protection licence fee paid once or every year?
Every year. A POTRAZ data controller licence is valid for 12 months and you must apply for renewal at least three months before it expires, on Form DP1 with the same tier fee. Missing the renewal leaves you processing unlicensed.
SI 155 states that a licence is valid for 12 months subject to compliance, and that a licensee "shall apply for renewal of the licence at least 3 months before the date of expiry of the licence". The renewal application uses the same Form DP1 and the same tier fee as the original application. There is no multi-year licence and no reduced …
How do I know which POTRAZ licence tier my business is in?
Your POTRAZ licence tier is decided by the total number of individuals whose personal information you hold: current and former staff, job applicants, customers and leads, subscribers, supplier contacts, and people on retained CCTV footage. Under SI 155 of 2024, 50 to 1,000 people is Tier 1, 1,001 to 100,000 is Tier 2, 100,001 to 500,000 is Tier 3 and over 500,000 is Tier 4.
The First Schedule to SI 155 defines the tiers by number of "data subjects", and a data subject under section 3 of the Act is any identifiable individual to whom personal information relates. The count is of people, not of records or transactions, and it is not limited to customers. Declaring a lower tier than the truth is a breach of you…
Can a group of companies share one POTRAZ data controller licence?
No. Each legal entity that decides why and how it processes personal information is its own data controller and needs its own POTRAZ licence under SI 155 of 2024. A group can, however, share a single certified Data Protection Officer.
The Act attaches the duties of a data controller to the "natural person or legal person" that determines the purposes and means of processing (section 3). A subsidiary is a separate legal person, with its own employees, customers and contracts, so it is a separate controller. SI 155 licenses "data controllers", not groups. By contrast, no…
What documents do I need to apply for a POTRAZ data controller licence?
To apply for a POTRAZ data controller licence you need Form DP1, your company registration documents, proof of payment of the tier fee, the details of your Data Protection Officer (Form DP2) and a description of what personal data you process, why, and for roughly how many people. POTRAZ has 14 days to approve or reject the application.
SI 155 prescribes Form DP1 for licence applications and renewals and Form DP2 for DPO notifications, and requires the applicant to disclose the nature and extent of the personal information it processes. Section 10 of SI 155 then lists what a licensed controller must notify to the Authority: all processing activities, modifications to ind…
Do I need the POTRAZ licence before I start trading, or can I register later?
Before. The transition period for existing businesses under SI 155 of 2024 ended on 12 March 2025, so there is no grace period left. A new business should apply for its POTRAZ data controller licence as soon as it collects personal information from 50 or more people, which for most businesses happens within the first weeks.
SI 155 makes it an offence to process personal information as a data controller without a licence once the transition period has passed. The six-month window was a one-off concession for controllers already operating on 13 September 2024. A business that starts today is not "existing" and cannot rely on it; it must be licensed before it i…
My business grew into a higher POTRAZ licence tier. Do I have to upgrade mid-year?
Yes. You must regularise your POTRAZ licence when you move into a higher tier. The tier is a condition of your licence, and SI 155 of 2024 requires data controllers to notify POTRAZ of material changes to their processing rather than waiting for renewal.
The licence is issued for a specific tier and "subject to compliance with the Act, these regulations and licence conditions". Section 10 of SI 155 requires the controller to notify the Authority of its processing activities and of changes to them. A controller that has quadrupled its data subject count is no longer processing within the t…
What happens if I forget to renew my POTRAZ data controller licence?
If your POTRAZ data controller licence expires, you are processing personal information without a licence, which is the same criminal offence as never having registered: a fine of up to level 11 or up to seven years' imprisonment, or both. Renewal applications are due at least three months before expiry.
SI 155 provides that the licence is valid for 12 months and that renewal must be applied for at least three months before expiry. The Regulations make processing without a valid licence an offence, and they do not provide a grace period after expiry. POTRAZ may also treat a late renewal as a breach of licence conditions when deciding whet…
Are there hidden POTRAZ charges beyond the licence fee?
No hidden charges. The Second Schedule of SI 155 of 2024 lists only three fees: the tier licence fee (USD 50, 300, 500 or 2,500 a year), the USD 30 application fee for Tiers 2 to 4, and the Data Protection Officer training and certification fee of USD 1,250 per person for Zimbabwean citizens or USD 1,450 for international candidates.
The Second Schedule to SI 155 is the complete fee list. It reads: application fees for Tier 2, 3 or 4 licences, USD 30; Tier 1 licence, USD 50; Tier 2, USD 300; Tier 3, USD 500; Tier 4, USD 2,500; DPO training and certification fees, Zimbabwean citizens USD 1,250 per person, international USD 1,450 per person. There are no per-record, per…
Do I have to register CCTV, my website or my mobile app separately with POTRAZ?
No separate POTRAZ licences are needed for CCTV, a website or a mobile app, but each is a processing activity you must describe in your licence application and notify to POTRAZ if it materially changes. SI 155 of 2024 also requires specific notification when you process biometric or genetic data and when you transfer personal data internationally.
Section 10 of SI 155 requires the data controller to notify the Authority of "all processing activities", of modifications to indirectly collected data, of international data transfers and of biometric or genetic processing. The Act itself (section 12) restricts the processing of genetic and biometric data to cases of written consent or a…
Do I need to notify POTRAZ every time I start a marketing campaign or hire a new supplier?
No. Under SI 155 of 2024 you notify POTRAZ of your processing activities and of material changes to them, not of every individual marketing message or supplier contract. A new type of processing (a customer app, biometrics, foreign hosting) is worth notifying; a promotion to your existing list is not.
Section 10 of SI 155 speaks of notifying "processing activities", which are categories of processing defined by purpose (payroll, customer sales, marketing, CCTV, recruitment), not individual operations. The Act's own rules on direct marketing (section 15: the right to object "by request and free of charge") govern how you run a campaign,…
Does my ZIMRA tax clearance or shop licence count as POTRAZ data protection registration?
No. The POTRAZ data controller licence is a separate requirement under the Cyber and Data Protection Act and SI 155 of 2024, issued by POTRAZ. Your ZIMRA tax clearance, NSSA registration and municipal shop licence prove that you exist and pay tax; they say nothing about how you handle personal information.
Section 5 of the Act designates POTRAZ as the Data Protection Authority, and SI 155 gives POTRAZ alone the power to license data controllers. No other regulator's licence is recognised as a substitute, and the Act does not contain any "deemed compliance" provision for businesses registered elsewhere. Sector regulators (Reserve Bank, Medic…
If I pay the POTRAZ licence fee, am I fully compliant with the CDPA?
No. The POTRAZ data controller licence is a permit, not a certificate of compliance. It is granted subject to compliance with the Act, the Regulations and licence conditions, which means you must also appoint a certified Data Protection Officer, keep personal data secure, tell people what you do with it, respect their rights and report breaches to POTRAZ within 24 hours.
SI 155 states that a licence is "valid for a period of 12 months subject to compliance with the Act, these regulations and licence conditions". The Act's substantive duties sit elsewhere: lawful processing (section 10), written consent for sensitive data (section 11), duties of the controller (section 13), information to data subjects (se…
Can POTRAZ refuse, suspend or revoke my data controller licence?
Yes. POTRAZ can reject a licence application, and it can suspend, revoke or refuse to renew a data controller licence where you breach the Cyber and Data Protection Act, SI 155 of 2024 or your licence conditions. Any POTRAZ decision can be appealed to the Administrative Court under section 34 of the Act.
SI 155 requires the Authority to approve or reject an application within 14 days and conditions the licence on continued compliance; a licence granted subject to conditions can be withdrawn when those conditions are broken. Section 6 of the Act gives POTRAZ the function of ensuring lawful processing and investigating complaints. Section 3…
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.