How do I know which POTRAZ licence tier my business is in?
Short answer
Your POTRAZ licence tier is decided by the total number of individuals whose personal information you hold: current and former staff, job applicants, customers and leads, subscribers, supplier contacts, and people on retained CCTV footage. Under SI 155 of 2024, 50 to 1,000 people is Tier 1, 1,001 to 100,000 is Tier 2, 100,001 to 500,000 is Tier 3 and over 500,000 is Tier 4.
What the law says
The First Schedule to SI 155 defines the tiers by number of "data subjects", and a data subject under section 3 of the Act is any identifiable individual to whom personal information relates. The count is of people, not of records or transactions, and it is not limited to customers. Declaring a lower tier than the truth is a breach of your licence conditions, which SI 155 makes a ground for refusal, suspension or revocation.
Example
A supermarket in Gweru counts only its 1,800 loyalty-card holders and applies as Tier 2. In fact it also holds 90 staff files, 400 CVs, 150 supplier contacts and 30 days of CCTV covering thousands of shoppers. Still Tier 2, but when a POTRAZ inspector asks for the record of processing activities, the CCTV and HR data are missing from the licence description, which looks like concealment. Conversely, a bus company that guesses "Tier 1" for its 15,000 ticketed passengers with phone numbers has under-declared and is in breach.
In practice
Build a one-page record of processing activities first (Q93), add up the people in each row, and choose the tier from the total. Where numbers fluctuate, use the peak you can reasonably expect during the licence year. The difference between Tier 1 and Tier 2 is USD 280 a year; the difference between an honest tier and a false one is your credibility with the regulator.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.