Starting September 1, 2026, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) will begin mandatory compliance inspections under the Cyber and Data Protection Act, working through a priority list that runs from banks and insurers down through healthcare providers, mining firms, religious organisations, schools and NGOs (Techzim; Veritas Bill Watch 27-2026). The inspections, formalised in Regulatory Notice 2 of 2026, check whether organisations hold a data controller licence, have appointed a certified Data Protection Officer, and meet the Act's security and breach-reporting standards.
The case for the regime
Zimbabwe's underlying problem is real. Churches run WhatsApp broadcast lists with thousands of congregant phone numbers; clinics keep digital patient files; microfinance apps harvest contact books. None of this was governed by enforceable data-security rules before the 2021 Act. A licensing-and-inspection authority that can require breach disclosure within 24 hours to POTRAZ and 72 hours to affected individuals, and that can audit whether an insurer is actually encrypting customer records, addresses a genuine gap — one plenty of comparable jurisdictions filled with similarly empowered regulators. Data controllers processing 50 or more people's information needing a licence, and enforcement carrying real teeth (a Level 11 fine or up to seven years' imprisonment for a CEO who processes data without one), is not, on its face, an unreasonable design for a country that had no data protection authority at all five years ago.
Where the design breaks down
The problem is who holds the inspection power and what checks that power. POTRAZ was created as Zimbabwe's telecoms regulator; the Cyber and Data Protection Act layered the Cybersecurity Centre and Data Protection Authority functions onto the same body, and its board members are appointed by the President after consultation with the responsible minister, who can also issue general policy directives to it (MISA Zimbabwe; Veritas Bill Watch 29-2026). An authority with that appointment chain is now empowered to inspect the membership lists of civil society organisations whenever it decides their processing presents "specific risks" to privacy — a standard the Act does not define with any precision, and one Veritas's Bill Watch flags directly as lacking "statutory guardrails to prevent undue restrictions being imposed in the future on freedoms of association, expression and the media."
The sensitive-data provisions compound the exposure. The Act restricts processing of political affiliation, health information and criminal history without written consent — categories that describe exactly the records an opposition-aligned NGO, a human rights clinic, or an investigative newsroom necessarily holds in the ordinary course of its work. MISA Zimbabwe's formal position on the implementing regulations goes further, warning that licensing decisions "could face political interference, potentially denying permits to disfavored media outlets without clear due process protections" — the same concern raised when the Act was still a bill, now arriving as an operational inspection schedule with religious organisations and NGOs explicitly on the priority list.
Cost as a second filter
Even leaving inspection discretion aside, the compliance economics themselves are a filter on which organisations survive. Data protection licences range from $50 to $2,500 annually, and Data Protection Officer certification runs from roughly $1,250 — a real line item for a rural clinic or a small congregation, negligible for a bank. MISA Zimbabwe's own submission argues schools, clinics and charities should not face the same licensing bar as commercial data controllers, since their core function is not the kind of large-scale commercial processing the licensing regime was built to police. Regulatory Notice 2 of 2026 does not distinguish; it lists religious organisations directly under financial institutions and healthcare providers in the same inspection queue.
What proportionate looks like
None of this argues against Zimbabwe having a data protection law. It argues against enforcing one through a regulator whose board the executive appoints and directs, absent the independence guarantees — insulated appointment processes, judicial or parliamentary appeal of licensing decisions, a defined and narrow "specific risk" test for triggering an inspection — that would let organisations distinguish a genuine security audit from a pretext. Kenya's Office of the Data Protection Commissioner and South Africa's Information Regulator both sit at arm's length from ministries in ways POTRAZ, doubling as telecoms regulator, cybersecurity centre and data authority under one presidentially-appointed board, does not. Until Zimbabwe separates those functions or builds in independent appeal, every inspection POTRAZ conducts of an NGO's membership rolls or a church's congregant list will carry a credibility problem the underlying law didn't need to have.