The mechanics of the sweep
Zimbabwe's Postal and Telecommunications Regulatory Authority (POTRAZ), designated the country's Data Protection Authority under Section 5 of the Cyber and Data Protection Act [Chapter 12:07], published Regulatory Notice 2 of 2026 on July 28, giving the market roughly five weeks' notice before nationwide compliance inspections begin on September 1, 2026. The inspections enforce Statutory Instrument 155 of 2024, the licensing regulations gazetted in September 2024 that required every organisation processing the personal data of 50 or more people to register as a "data controller," pay a tiered licence fee, and appoint a certified Data Protection Officer (DPO).
The rollout is risk-based rather than blanket. POTRAZ says it will start with sectors holding the most sensitive or high-volume data — financial institutions, insurers, local authorities, healthcare providers and mining companies — before moving down to religious organisations, schools, professional bodies, government ministries and NGOs, according to Zimbabwe's parliamentary monitoring newsletter Veritas Bill Watch and reporting by Techzim.
The stakes are real. Under Section 3(3) of SI 155, anyone who processes personal data without a licence "shall be guilty of an offence and liable to a fine not exceeding level 11 or to imprisonment for a period not exceeding seven years or to both such fine and such imprisonment" — the same penalty attaches to letting a licence lapse (Section 5(3)), mishandling a child's data (Section 10(6)), or failing to secure a breach (Sections 16(7) and 17(6)). Failing to appoint a DPO at all draws a lighter penalty — a level 7 fine or up to two years (Section 12(6)) — a distinction some coverage has blurred by treating "up to seven years" as the across-the-board number.
Licence fees scale from $50 for a Tier 1 controller (50–1,000 data subjects) to $2,500 for a Tier 4 controller (500,000+), plus a $30 application fee. DPO certification costs $1,250 for Zimbabwean citizens and $1,450 for foreign nationals — real money for the NGOs, churches and small outlets now inside the inspection net.
The case for enforcement
There is a legitimate regulatory gap here, and POTRAZ's critics rarely deny it. Zimbabwe had no operative data-controller registry until the March 12, 2025 deadline, meaning banks, hospitals, insurers and telcos had processed biometric, financial and health data for years with no licensing check, no mandatory breach reporting, and no accountable officer. That deadline came and went with what MISA Zimbabwe and Techzim both describe as widespread non-compliance. A regulator that gazettes a rule, gives the market roughly a year to comply, and only then inspects — starting with the highest-risk data holders rather than raiding small NGOs first — is following a defensible, phased enforcement ramp, not an ambush. Mandatory 24-hour breach notification to POTRAZ and 72-hour notification to affected individuals (Section 17 of SI 155) is a genuine improvement, and regional peers Kenya, Nigeria and South Africa have all built comparable licensing-plus-DPO frameworks without becoming outliers.
Where the design breaks down
The problem isn't that Zimbabwe wants data controllers licensed. It's the criminal penalty wrapped around a paperwork failure, layered onto a regulator that was never built to be independent. Up to seven years in prison for processing without a licence is disproportionate to the harm of an administrative lapse — it is the same sentence exposure the Act reserves for an actual security breach that harms a data subject. That asymmetry matters because Section 5 of the Act hands the Data Protection Authority function to POTRAZ, already the telecoms sector regulator, and while Section 6(2) states the Authority "shall not... be subject to the direction or control of any person or authority" in exercising that specific function, POTRAZ's board is appointed by the President after consulting the responsible minister and remains bound to comply with the minister's general policy directives on everything else it does. MISA Zimbabwe flagged this exact structure in its 2021 analysis of the Act as creating "a super administrative authority" without the institutional separation a genuine watchdog needs — and Zimbabwe's own parliamentary portfolio committees reportedly recommended splitting the Data Protection Authority into a standalone body rather than folding it into POTRAZ.
That weakness is what turns "data protection enforcement" into something closer to a social-media surveillance risk. The same Act that created POTRAZ's licensing power also amended the Interception of Communications Act to establish a Cyber Security Centre — meaning the instrument enforcing privacy compliance is the same one that expanded the state's lawful-interception apparatus. MISA's 2021 analysis specifically warned that the Cyber Security and Monitoring Centre, housed in the President's Office, gives the executive a parallel channel for monitoring critics, citing how #ZimbabweanLivesMatter participants were branded "enemies of the State" under adjacent digital-conduct provisions. A licensing regime with criminal exposure, administered by a regulator answerable to that same executive, creates an obvious lever: an NGO, independent outlet or opposition-aligned body that falls behind on a $1,250 DPO certification fee is now, on paper, exposed to the same seven-year sentence as a bank that loses a hard drive of customer records.
The proportionate fix
None of this requires Zimbabwe to abandon data protection. It requires decoupling licensing lapses from breach-level criminal exposure, and separating the Data Protection Authority from the telecoms regulator and its executive-appointed board — exactly what Parliament's own committees already recommended. Until that happens, POTRAZ's September 1 inspections will enforce a real and needed law through an institution structurally unsuited to enforcing it fairly.