Data Protection Act Compliance: A Checklist for Zimbabwe Businesses

Quick grounding first: if you collect any personal information about people (names, phone numbers, emails, ID numbers, payment details), the Act applies to you. That's almost every business. For the full background, see our overview of the Data Protection Act 2021. This piece is the action list.

1. Know what data you hold

You can't protect what you haven't mapped. Write down what personal data you collect, where it lives (spreadsheets, your website, WhatsApp, a CRM), who can access it, and how long you keep it. This single exercise surfaces most of your risk.

2. Have a lawful reason for collecting it

For each type of data, you should be able to say why you have it: a contract, the customer's consent, a legal requirement. If you're collecting something "just in case" with no real reason, stop collecting it.

3. Publish a clear privacy policy

Your website needs a privacy policy that tells people, in plain language, what you collect, why, who you share it with, and how they can ask to see or delete their data. This is one of the most visible signs of compliance, and one of the easiest to fix.

4. Get consent properly

• Don't pre-tick boxes. Consent has to be a genuine choice.
• Separate marketing consent from the main transaction. Let people buy without being forced onto your mailing list.
• Make opting out easy: an unsubscribe link that actually works.

5. Secure the data (the technical part)

The Act expects "appropriate" security. In practice that means the basics done properly:

• HTTPS on your website and any form that collects data.
• Strong, unique passwords and two-factor authentication on admin accounts.
• Access control: only staff who need the data can reach it.
• Backups and a patched, up-to-date website.

A security assessment is the fastest way to know whether your "appropriate security" would actually hold up.

6. Have a breach plan

Decide now what you'd do if data were exposed: who's responsible, how you'd contain it, and how you'd notify the regulator and affected people. Our guide on what to do when your website is hacked walks through the response.

7. Respect people's rights

People can ask what data you hold about them, ask you to correct it, or ask you to delete it. Have a simple process so that when a request comes in, you're not scrambling.

8. Check whether you need a POTRAZ licence

Under Statutory Instrument 155 of 2024, an organisation that processes the personal data of 50 or more people must hold a data controller licence from POTRAZ. The deadline to comply was 12 March 2025, so if you cross that threshold and have not applied, this is the most urgent item on the list. The licence category and fee depend on how much data you process, so confirm yours with POTRAZ directly. We do not issue licences and cannot apply on your behalf; we help with everything around it, including the security evidence an application asks about. Not sure if you are over the threshold? The POTRAZ licence checker answers it in six questions.

The short version

Map your data, justify why you hold it, tell people the truth in a privacy policy, get consent honestly, secure it properly, and know what you'd do in a breach. Do those things and you're in a much better position than most businesses, and genuinely protecting the customers who trusted you with their information.

For the security half of that list, our free website security check tells you where you stand in seconds. For the compliance half, our data protection readiness assessment works through the Act section by section and gives you the evidence trail in writing.