If I pay the POTRAZ licence fee, am I fully compliant with the CDPA?
Short answer
No. The POTRAZ data controller licence is a permit, not a certificate of compliance. It is granted subject to compliance with the Act, the Regulations and licence conditions, which means you must also appoint a certified Data Protection Officer, keep personal data secure, tell people what you do with it, respect their rights and report breaches to POTRAZ within 24 hours.
What the law says
SI 155 states that a licence is "valid for a period of 12 months subject to compliance with the Act, these regulations and licence conditions". The Act's substantive duties sit elsewhere: lawful processing (section 10), written consent for sensitive data (section 11), duties of the controller (section 13), information to data subjects (sections 15 and 16), security (section 18), breach notification (section 19), accountability (section 24) and cross-border transfers (section 28). Section 33 attaches penalties to breaches of these duties regardless of whether a licence is held.
Example
A car dealership in Harare obtains its Tier 1 licence and frames it in reception. It has no DPO (the form named a salesman who never took the course), keeps customers' ID copies and bank statements in an open shared drive, and sends marketing SMS with no opt-out. When a customer complains to POTRAZ about the SMS, the investigation reveals all three failures. The licence on the wall does not help; it merely shows that the dealership knew about the law.
In practice
Use the licence as the starting point. In the same month, appoint and certify the DPO, write the one-page data inventory and privacy notice, sign processor agreements, tighten access to files, and prepare the breach plan. The licence is the driver's licence; the rest is driving properly.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.