Do you need a POTRAZ data controller licence?

Under Statutory Instrument 155 of 2024, organisations holding the personal data of 50 or more people need one, and the deadline was 12 March 2025. Six questions, about two minutes, and you will know where you stand and what to do next.

Question 1 of 6

Does your organisation keep personal information about people?

Names, phone numbers, ID numbers, addresses, staff files, customer lists, student or patient records. Spreadsheets and WhatsApp count.

Nothing you choose here is stored or sent anywhere.

What this checks

Whether your organisation keeps personal information about anyone, including staff files, customer lists and WhatsApp contacts.
Roughly how many people's information you hold, measured against the threshold of 50 people.
Whether the records include children, health, ID numbers or finances.
Whether you already hold a POTRAZ data controller licence, have appointed a Data Protection Officer and notified POTRAZ, and give people a privacy notice.

Why it matters

Statutory Instrument 155 of 2024 requires organisations that process the personal data of 50 or more people to hold a data controller licence from POTRAZ, and the compliance deadline was 12 March 2025. Schools, clinics, pharmacies and businesses reach that number quickly once staff, customers, students, parents and patients are counted together. This checker gives a plain answer in about two minutes and lists next steps that fit your answers.

How to read the result

Licence needed means your answers put you at or above the 50 person threshold without a licence.
Likely needed usually means you were unsure of a number. Count properly before deciding; the threshold counts everyone whose information you hold.
If you already hold a licence, remember it lasts 12 months, so check the issue date and plan the renewal.
This is general guidance, not legal advice. Confirm your category and any fee with POTRAZ directly.

How to fix what it finds

Complete the application on Form DP1, available from POTRAZ.
Appoint a Data Protection Officer and notify POTRAZ of the appointment, unless POTRAZ confirms your category is exempt (its licensing guideline exempts the smallest category, up to 1,000 people, depending on sector).
Budget for the licence fee, which POTRAZ sets by category in the range US$50 to US$2,500 (the larger categories also pay a US$30 application fee).
Publish a privacy notice wherever you collect personal information, such as forms, enrolment papers and your website.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

Who needs a POTRAZ data controller licence?

Under SI 155 of 2024, an organisation that processes the personal data of 50 or more people needs one. That count includes staff, customers, students, parents and patients together.

How much does a POTRAZ data protection licence cost?

Licence fees range from US$50 to US$2,500, depending on the category POTRAZ assigns to your organisation, and the larger categories also pay a US$30 application fee. Confirm your category and fee with POTRAZ.

How long is a data controller licence valid?

A licence lasts 12 months, so it needs renewing each year. Keep a record of the issue date so the renewal is not missed.