Can several companies share one Data Protection Officer in Zimbabwe?
Short answer
Yes. Several companies can share one Data Protection Officer in Zimbabwe. Nothing in SI 155 of 2024 prevents one certified person acting as DPO for several data controllers, and POTRAZ's 2025 DPO Guidelines accept shared and outsourced arrangements provided the person can genuinely perform the role for each organisation.
What the law says
SI 155 requires each controller to appoint "a data protection officer" and notify the Authority; it does not say the person must be exclusive to one controller. The Guidelines focus on capability and independence: the DPO must have the time, access and authority to carry out the section 14 functions for each controller, and each controller remains responsible for its own compliance. Each company files its own Form DP2.
Example
A group in Bulawayo with a bakery, a transport company and a property firm appoints its group finance director, once certified, as DPO for all three (three Forms DP2). Separately, an association of 15 pharmacies in Harare contracts one certified pharmacist-turned-compliance consultant as their shared DPO; each pharmacy pays a share of the retainer, files its own Form DP2, and gets a quarterly visit and a common set of policies adapted to each shop.
In practice
Shared DPOs work when the workload is realistic (a person cannot serve 200 controllers meaningfully), when each controller signs its own appointment letter or service agreement, and when the DPO has a deputy or backup for breach response. Clusters of small businesses in the same trade association are natural candidates; the association can also sponsor a sector code of conduct (Q99).
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.