Do I need the POTRAZ licence before I start trading, or can I register later?
Short answer
Before. The transition period for existing businesses under SI 155 of 2024 ended on 12 March 2025, so there is no grace period left. A new business should apply for its POTRAZ data controller licence as soon as it collects personal information from 50 or more people, which for most businesses happens within the first weeks.
What the law says
SI 155 makes it an offence to process personal information as a data controller without a licence once the transition period has passed. The six-month window was a one-off concession for controllers already operating on 13 September 2024. A business that starts today is not "existing" and cannot rely on it; it must be licensed before it is a data controller within the tiers, which means at 50 data subjects.
Example
Two graduates in Harare launch a food delivery app in October 2026. In week one they have 12 riders and 30 restaurant contacts (42 people). In week three they have 900 registered customers. They should have filed Form DP1 and Form DP2 in week two, when they were about to cross 50. Filing at week three with a note that the app launched on a specific date, and with the DPO's certification booked, is a defensible position; waiting until "we have traction" is not.
In practice
Build the licence into your launch checklist alongside company registration, ZIMRA and the bank account. Appoint the DPO first (you will need the Form DP2 anyway), then file the licence application the moment your user or staff count approaches 50. The application takes 14 days, so start early.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.