Soho Connect Research DeskZimbabwe cyber law, data protection and POTRAZ guidance connected to real decisions.
Start with source-linked guidance on inspections, Data Controller licensing, DPO duties, breach reporting and technical evidence. The reference currently contains 16 governed claims, 6 sources and 4 preserved uncertainties.
Available decision paths
Current verified claims
POTRAZ announced that mandatory risk-based compliance inspections and assessments of data controllers will begin on 1 September 2026.
Authority tier 3. Verified 2026-07-30. Event claim; not evidence of an official questionnaire or surprise-raid procedure.
The notice says the risk-based programme is starting with ten named sector groups and does not frame that list as permanently exclusive.
Authority tier 3. Verified 2026-07-30. Do not infer permanent exclusion for sectors not named in the initial list.
POTRAZ is designated as Zimbabwe's Data Protection Authority under the governing framework.
Authority tier 1. Verified 2026-07-30. Authority identification only; does not imply Soho Connect acts for POTRAZ.
SI 155 of 2024 establishes the Data Controller licensing and DPO appointment regulatory regime referenced by the inspection notice.
Authority tier 2. Verified 2026-07-30. Applicability must be assessed from the instrument and current official guidance; no universal licensing conclusion is implied.
The SI 155 fee schedule defines its first Data Controller licence tier as 50 to 1,000 data subjects.
Authority tier 2. Verified 2026-07-30. The fee threshold must not be converted into a blanket exemption from the Act.
The published annual Data Controller licence fees are US$50, US$300, US$500 and US$2,500 across Tiers 1 to 4, with a US$30 application fee shown for Tiers 2 to 4.
Authority tier 2. Verified 2026-07-30. These are regulatory fees, not Soho Connect prices; verify current official fees before payment.
A Data Controller Licence under SI 155 is valid for 12 months.
Authority tier 2. Verified 2026-07-30. Actual licence dates must be read from the organisation's issued records.
The regulations require a Data Controller Licence renewal application three months before expiry.
Authority tier 2. Verified 2026-07-30. The tool may calculate a planning date but cannot confirm acceptance of a renewal application.
Sources
- Tier 1: Cyber and Data Protection Act, 2021 [Chapter 12:07]
- Tier 2: Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 — SI 155 of 2024
- Tier 5: Data Protection Authority Implementation Guidelines
- Tier 9: POTRAZ starts data protection inspections on 1 September
- Tier 9: From creches to clinics: what POTRAZ data inspections mean
Open questions
The licensing trigger and the fee-tier threshold are separately drafted; the current record does not support treating organisations below 50 data subjects as exempt from the wider Act.
Written POTRAZ clarification, amended instrument or qualified legal interpretation.
No official detailed POTRAZ inspection questionnaire or scoring model was found in the sources reviewed.
Official POTRAZ checklist, questionnaire, assessment framework or inspection findings.
The notice names initial sectors but does not establish a complete sector order, site-visit cadence or timetable.
Official sector timetable or reliable published inspection practice.
The official notice was available to the research process as a user-supplied newspaper image but was not located as an official online POTRAZ document at publication time.
Official POTRAZ online publication or gazetted source.