My business grew into a higher POTRAZ licence tier. Do I have to upgrade mid-year?
Short answer
Yes. You must regularise your POTRAZ licence when you move into a higher tier. The tier is a condition of your licence, and SI 155 of 2024 requires data controllers to notify POTRAZ of material changes to their processing rather than waiting for renewal.
What the law says
The licence is issued for a specific tier and "subject to compliance with the Act, these regulations and licence conditions". Section 10 of SI 155 requires the controller to notify the Authority of its processing activities and of changes to them. A controller that has quadrupled its data subject count is no longer processing within the terms of its licence, and continuing on the old tier is a licence-condition breach that can lead to suspension or revocation.
Example
A solar equipment retailer in Bulawayo obtains a Tier 1 licence in January with 700 customers. A government rural electrification tender brings it 4,000 new household customers by June. It is now Tier 2. The DPO writes to POTRAZ, files an updated Form DP1 describing the new processing, and pays the difference to Tier 2 (USD 300 plus USD 30 application). At renewal the following January it renews as Tier 2 at USD 300.
In practice
Have the DPO review the data subject count every quarter (it is one line in the record of processing activities). When you cross a tier boundary, notify POTRAZ in writing within the month and pay the applicable fee. Keep the correspondence; it demonstrates good faith.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.