Do I need a POTRAZ data controller licence if I only have employees and no customer database?
Short answer
Yes. If your employee records alone cover 50 or more people, you need a POTRAZ data controller licence. Staff files are personal information, and by holding them you are a data controller under Zimbabwe's Cyber and Data Protection Act.
What the law says
"Personal information" under section 3 of the Act includes any information relating to an identifiable person, and the Act's section 11 list of sensitive data expressly covers health and criminal-history information, both of which sit in a typical HR file (sick notes, police clearances). SI 155's tiers are counted in "data subjects", not customers, and employees are data subjects. The Act does allow some employment-related processing without consent (sections 11 and 12 refer to obligations under employment law), but that concerns the lawful basis, not whether you must be licensed.
Example
A construction company in Bulawayo has 45 permanent staff, keeps files on 30 former employees for possible labour disputes, and has 80 CVs from its last recruitment round in a cabinet. It has no customer database because it works on tender contracts. It nevertheless holds data on about 155 people and is a Tier 1 data controller (USD 50 a year). The medical certificates and police clearances in those files are sensitive data, which raises the security expectations.
In practice
Count current staff, former staff whose files you kept, and applicants whose CVs you still hold. If the total is 50 or more, apply for the licence and appoint a DPO. While you are at it, set a retention rule for unsuccessful applicants' CVs (six to twelve months is typical), which reduces both your count and your risk.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.