Who is exempt from the POTRAZ data controller licence under SI 155 of 2024?
Short answer
Very few organisations. Section 8 of SI 155 of 2024 exempts processing for personal, family or household affairs and processing purely for journalistic, historical or archival purposes, and treats law-enforcement processing separately. No trading business, NGO, school or clinic falls under any of these exemptions.
What the law says
Section 8 of SI 155 lists the exempt purposes. It also adds that entities processing for law enforcement and journalistic purposes are still "required to register with the Authority, and to comply with data protection principles"; the exemption is from the ordinary licence and fee regime, not from the Act. Processing for historical or archival purposes is exempt only when that is the sole purpose.
Example
A community newspaper in Mutare holding notes and sources for its reporting is within the journalistic exemption for that material and need not pay a tier fee, but it must still register with POTRAZ and follow the principles; and for its 25 staff files and 1,200 subscribers it is an ordinary data controller. A family sharing photos and phone numbers in a WhatsApp group is entirely outside the Act. A funeral assurance company that says its policyholder records are "archival" is not exempt; the records are used to run a business.
In practice
If you are trading, assume you are not exempt. If you believe part of your processing falls under section 8, separate it clearly from your commercial processing, register with POTRAZ for the exempt part, and license the rest.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.