A Real Law, Finally Enforced
On September 1, 2026, Zimbabwe's Postal and Telecommunications Regulatory Authority (POTRAZ) began mandatory, nationwide compliance inspections of organisations that collect or process personal data, acting under Regulatory Notice 2 of 2026 and its authority as the country's Data Protection Authority under the Cyber and Data Protection Act [Chapter 12:07] (Techzim). The inspections are risk-based, starting with the sectors that hold the most sensitive personal data: banks, insurers, hospitals, local authorities, schools, universities, churches, government ministries, mining companies, professional bodies and NGOs.
The legal foundation predates this week's headlines. The underlying Data Protection Act was passed in 2021 (potraz.gov.zw), and the operative licensing framework — the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations — was gazetted as Statutory Instrument 155 of 2024 (potraz.gov.zw). Organisations had until March 12, 2025 to register; a compliance grace period ran through July 2026. September's inspections are the first real enforcement test of a regime that has existed on paper for years.
The Case For It
The strongest argument for POTRAZ's move is straightforward and worth taking seriously: Zimbabwean hospitals, banks, schools and government ministries hold enormous volumes of sensitive personal data — health records, national ID numbers, biometric data, financial histories — with essentially no independent audit regime until now. A law with no inspection mechanism behind it is a suggestion, not a safeguard. Mandatory breach reporting (to POTRAZ within 24 hours, to affected individuals within 72 hours if the breach is serious) and a licensing floor that at least forces organisations to name a responsible data protection officer are basic institutional hygiene that most functioning privacy regimes — from the EU's GDPR to Kenya's Data Protection Act — already require. Zimbabwe is not inventing a new category of regulation; it is catching up to global norms that emerged over the last decade.
Where the Design Goes Wrong
The execution, however, imposes costs poorly matched to risk. SI 155 sets a flat, tiered licence fee — from $50 for organisations processing 50–1,000 people's data up to $2,500 for the largest controllers — plus a mandatory $1,250 certification course (plus a $30 application fee) for every appointed data protection officer (Techzim). Processing personal data without a licence carries a level 11 fine or up to seven years in prison for the responsible executive.
Those numbers land very differently on a commercial bank than on a rural church or a community NGO — precisely the entities POTRAZ has flagged for inspection. CITE's reporting captured the objection plainly: legal expert Dr. Vusumuzi Sibanda called Zimbabwe's registration-and-fee model "new and strange" globally and asked why churches and voluntary organisations collecting basic membership rolls should face the same licensing cost structure as a data-driven business; analyst Mxolisi Ncube warned that compliance costs will likely be passed through to consumers via higher airtime and data prices (CITE). A privacy law that a small NGO cannot afford to comply with does not protect the people whose data that NGO holds — it just pushes the NGO into non-compliance, converting a data-protection statute into a licensing tax with prison exposure attached.
The Independence Problem
A second concern cuts closer to POTRAZ's legitimacy as a regulator. MISA Zimbabwe's formal analysis of the licensing regulations flags that POTRAZ's governing board is appointed by the President, and argues this undermines the statutory claim that the Data Protection Authority acts independently of political interference (MISA Zimbabwe). Because the regulations give POTRAZ discretion over granting, delaying or denying data controller licences — with no specified due-process procedure for a rejected applicant — the same licensing power that legitimately targets an unregistered bank could, in principle, be used to slow-walk or deny a licence to a disfavoured media outlet or advocacy NGO, effectively shutting down its ability to operate. MISA also notes the exemption list is narrower than it should be: schools, clinics and charities process personal data as a core, non-commercial function, yet none of them qualify for the exemptions currently limited to personal/household use and journalism.
What Proportionate Regulation Would Look Like
None of this argues against enforcing data protection in Zimbabwe. It argues for calibration. A tiered fee schedule based on revenue or commercial purpose — rather than raw headcount of data subjects — would let POTRAZ inspect a hospital's cybersecurity practices without pricing a rural church out of legal compliance. A published, appealable process for licence denials would close the door MISA has identified without weakening breach-reporting or audit powers. And structurally separating board appointments from direct presidential control would let POTRAZ's inspection regime earn the credibility that comes from enforcing rules evenhandedly — bank and NGO alike — rather than being read, correctly or not, as a lever available to the executive. Zimbabwe's data protection law addresses a genuine gap. Whether it protects citizens or becomes another cost of doing civil society in Zimbabwe depends entirely on how selectively that discretion gets used from here.