Zimbabwe's Cyber and Data Protection Act came into force in 2021, and it applies to almost every business that collects customer information: names, phone numbers, ID numbers, payment details, the lot. If you've been treating it as a problem for "big companies," this is the article to change your mind.
What the law requires
The Act sets out how organisations must collect, store, and handle personal data. In practical terms, if you hold information about customers or staff, you are expected to:
- Collect only what you need, and tell people why you're collecting it.
- Keep it secure, with appropriate technical safeguards against loss or theft.
- Get consent for how you use and share personal information.
- Allow access and correction: individuals can ask what you hold about them.
- Register where required, and appoint someone responsible for data protection.
Oversight sits with the regulator (POTRAZ acting as the Data Protection Authority), and the obligations apply regardless of how small your business is.
On licensing specifically: under Statutory Instrument 155 of 2024, an organisation that processes the personal data of 50 or more people must hold a data controller licence from POTRAZ, and the deadline to comply was 12 March 2025. Confirm the category that applies to you with POTRAZ directly, or use the POTRAZ licence checker to see where you stand in two minutes.
What happens if you're not compliant
Non-compliance is not a paperwork inconvenience. The Act sets out fines and, for some offences, prison terms. For the exact figures, read the Cyber and Data Protection Act [Chapter 12:07] itself or ask a lawyer. Beyond the legal exposure, there's the cost that doesn't appear in any statute:
- Reputational damage. A public data breach in Zimbabwe's tight business community travels fast.
- Lost customers. People don't come back to a business that leaked their ID and payment details.
- Liability. Affected individuals can pursue you for mishandling their data.
The cheapest breach is the one that never happens. Compliance is mostly about getting the basics right before something goes wrong.
How a security audit helps you comply
"Keep personal data secure" is the part of the Act most businesses struggle to evidence, because they don't actually know how secure their systems are. A security audit answers that directly. It tells you:
- Where personal data is exposed or inadequately protected.
- Which systems are running outdated, vulnerable software.
- Whether your website leaks information it shouldn't.
- What concrete steps close those gaps, ranked by risk.
That report becomes your evidence trail: proof that you assessed your security posture and acted on it. If the regulator ever asks what steps you took to protect data, "we commissioned an assessment and fixed the findings" is a far stronger answer than silence.
Start with what's free
You don't have to commit to a full audit to begin. Our free website security check is a no-risk first step that shows you where your most obvious data-protection gaps are, and gives you a clear, prioritised path to closing them. When you are ready to go further, our data protection readiness assessmentmaps your position against the Act section by section.
Services this guide relates to
See where your customer data is exposed
The free website check is a passive scan of what your site shows the public. It takes about a minute and is the first practical step toward Data Protection Act compliance.
Run the free website checkDonovan Mudarikwa
Founder, Vanorika Technologies
Security-focused software engineer and penetration tester based in Harare, working with businesses across Zimbabwe and beyond. Founder-led, so you deal directly with the person doing the work.