What happens if I skip data protection training in Zimbabwe?
Short answer
Without POTRAZ-approved certification your Data Protection Officer appointment is incomplete, which puts you back in the "no DPO" position (fine up to level 7 or up to two years). Without staff awareness you will struggle to show "appropriate organisational measures" if a breach happens, and breaching the security duty carries the top penalty (level 11 or up to seven years).
What the law says
SI 155 requires DPO certification and penalises the absence of a DPO. Section 18 of the Act requires technical and organisational measures, and section 33 penalises a controller who contravenes section 18 with "a fine not exceeding level 11 or imprisonment for a period not exceeding seven years or both". Section 16 of SI 155 requires organisational policies and regular testing of their effectiveness. A controller with no training programme has, by definition, no evidence of organisational measures.
Example
Two clinics in Harare suffer identical incidents: a receptionist emails a patient list to the wrong address. Clinic A has a certified DPO, an annual training register showing the receptionist's attendance, and a breach plan; it notifies POTRAZ within 24 hours and can show the failure was individual. Clinic B has none of these; its DPO was never certified, nobody knew about the 24-hour rule, and the incident surfaces via a patient's complaint. POTRAZ's file on Clinic B records an uncertified DPO, a late notification and no organisational measures.
In practice
Certify the DPO, then run the annual staff session. An hour a year with your staff is the cheapest insurance against the most expensive offence in the Act.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.