Can a customer or former employee report my business to POTRAZ?
Short answer
Yes. Investigating complaints is one of POTRAZ's core functions under section 6 of the Cyber and Data Protection Act, and any person can lodge one. Former employees know exactly what data you hold and how it is handled, and dismissal disputes are a classic trigger.
What the law says
Section 6 lists among the Authority's functions investigating complaints and ensuring that data controllers process personal information lawfully. Section 14 gives every data subject rights whose denial is a natural ground of complaint. SI 155 requires controllers to respond to POTRAZ information requests on breaches within 14 days, and the Authority can suspend or revoke a licence for non-compliance. Section 34 gives the controller a right of appeal to the Administrative Court against any adverse decision.
Example
A Harare security company dismisses a guard who then tells POTRAZ that the company photographs every visitor's ID at client sites, keeps the photos on guards' personal phones and has no licence. POTRAZ writes asking for the licence, the DPO's details, the processing record and the visitor-data procedure. The company has 14 days to respond and nothing to show. Its competitor, facing a similar complaint from an ex-employee, produces its licence, DPO certificate, a visitor-data procedure and the training register within two days, and the file is closed.
In practice
Assume the complaint will come from someone who knows your weaknesses. A licence, a certified DPO, a request log and a training register turn a complaint into correspondence rather than a prosecution. Never ignore a letter from the Authority; respond fully and on time.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.