What actually happened, and what did not
Zimbabwe's Postal and Telecommunications Regulatory Authority (POTRAZ) is reported to have begun mandatory data-protection inspections on 1 September 2026 under Regulatory Notice 2 of 2026. Coverage describes a risk-based programme aimed first at banks, hospitals, schools, mining firms and churches. We could not retrieve the notice itself or the Herald and Techpoint pages that carry the date. One Business Times report instead says large-scale audits begin in the fourth quarter of 2026, with POTRAZ's data protection director promising to "intensify audits" from then. Treat the start date as reported, not confirmed.
This is not a story about a new social media monitoring programme. We found no verified report of one in the last 60 days. It is a story about a regulator acquiring a practical, large-scale ability to inspect what organisations know about people, in a country where membership of a political group, church or union is itself sensitive. That is where the surveillance risk sits.
The strongest case for the inspections
Regulators have a fair argument. Zimbabwe passed the Cyber and Data Protection Act [Chapter 12:07] in 2021, and Statutory Instrument 155 of 2024 required existing data controllers to apply for a licence within six months. That window closed in March 2025. A law with no enforcement protects nobody. Breaches at banks, schools and clinics expose ordinary people to fraud, and a licensing regime with no inspections would soon become a paper exercise. Inspecting the sectors that hold the most sensitive data first is a defensible way to use limited staff.
What the law gives the regulator
The statute is broad. Section 5 of the Act designates POTRAZ as the Data Protection Authority. Section 6(1)(f) lets it investigate "of its own accord" and "request the disclosure of any documents that may be of use" to an inquiry. No court warrant is mentioned in that provision.
The licensing threshold is low. Under section 6 of SI 155 of 2024, a Tier 1 licence covers anyone processing information on a minimum of 50 data subjects, and there are four tiers up to more than 500,000. A small NGO with a few dozen members, a trade union branch or a village savings group can easily cross 50. Failing to hold a required licence is an offence carrying a fine up to level 11 or imprisonment of up to seven years, or both (section 3(3)).
The exemptions do not obviously cover civil society. Section 8 exempts personal and household processing, law enforcement, and journalistic, historical or archival purposes. Law enforcement and journalism must still register and follow the Act's principles. NGOs and membership bodies get no carve-out.
Why membership lists are the pressure point
The Act itself treats this data as sensitive. Section 3 defines "sensitive data" to include political opinions, membership of a political association, a professional or trade association and a trade union, and religious beliefs. Section 11 bars processing sensitive data without written consent. An inspector reviewing whether an NGO complies with that rule will, almost by definition, need to look at the list of who belongs to it.
That creates a perverse loop. The compliance check that protects members from misuse could itself deliver their names to a state body. The Act does not say what POTRAZ may do with documents it collects, how long it keeps them, or whether it may share them with other state agencies. Where a data protection regulator is also the state's technology and security regulator, the absence of firewalls matters more.
MISA Zimbabwe raised this concern in May 2020, when the Bill was gazetted. According to Business Times, it objected to one body acting as telecoms regulator, Cyber Security Centre and Data Protection Authority, warning that POTRAZ could become the state's "surveillance arm" given its access to operator and ISP data. Veritas, a Zimbabwean legislative monitor, has been reported to warn in Bill Watch 29/2026 that the regulator's powers could reach civil-society lists and that its board is not independent of the minister. We could not retrieve that bulletin, so we do not rely on it here.
On independence the picture is mixed. Section 6(2) of the Act says that, in exercising its functions under the Act, the Authority "shall not... be subject to the direction or control of any person or authority." That is a real protection on paper. But the Act also defines the "Minister" as the minister for information and communications technology, and it has POTRAZ advise and consult that minister on several functions, including cross-border cooperation. A statutory promise of independence is only as strong as the appointment and removal rules behind it. Those rules are in a different statute, the Postal and Telecommunications Act, whose text we could not retrieve for this piece.
A proportionate way forward
Protecting privacy is a good goal and POTRAZ has every right to inspect a bank's customer database. The problem is design, not intent. Four safeguards would keep the programme credible and reduce the chilling effect on civil society:
- Publish the notice and the methodology. Regulatory Notice 2 of 2026 should be on POTRAZ's website, with the inspection criteria and sector order, so that a 1 September versus Q4 confusion does not arise.
- Inspect systems, not membership rolls. Auditors can verify consent records, access controls and breach procedures using redacted or sampled data. Names are rarely needed to prove compliance.
- Add a purpose limit and a court check. Documents obtained under section 6(1)(f) should be used only for the compliance inquiry, deleted afterwards and not passed to other agencies without a warrant.
- Scale the threshold to the risk. A 50-person licensing trigger captures community groups that pose little privacy risk. A higher threshold for non-commercial bodies, or a lighter registration route, would focus scarce inspectors on large processors.
A data protection regime that treats an opposition-party supporter list as just another database is not protecting privacy. Zimbabwe can enforce its law and still protect the people the law is meant to serve, but only if the limits on the regulator are written as clearly as its powers.