Zimbabwe’s Cyber and Data Protection Act: What Every Business Must Know (2026)

Every time a customer submits an enquiry through a website, pays for a product, registers for an account or sends personal information to a business, that organisation takes on a responsibility.

It must handle that information appropriately, protect it from unauthorised access and understand what the law requires.

For many Zimbabwean businesses, data protection has traditionally been treated as an IT issue. A company might install antivirus software, secure its website and create backups, but still have no clear policy explaining how customer information is collected, stored, shared or deleted.

That approach is becoming increasingly difficult to justify.

Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07] establishes a legal framework for protecting personal information and strengthening confidence in the use of information and communication technologies. The Act is supported by regulations that introduce specific obligations for data controllers, including licensing, the appointment of Data Protection Officers and security breach notification.

For businesses operating in Zimbabwe, understanding these requirements is no longer something to leave until an audit or security incident.

This guide explains the Cyber and Data Protection Act, what it means for businesses, the responsibilities of data controllers and processors, and the practical steps organisations should take to improve their data protection practices.

This article provides general information, not legal advice. Businesses should consult the current legislation, POTRAZ guidance and qualified legal or data protection professionals when assessing their obligations.

What Is Zimbabwe’s Cyber and Data Protection Act?

The Cyber and Data Protection Act, 2021, is Zimbabwe’s principal legislation addressing cybersecurity, data protection and certain technology-related offences.

It is cited as the Cyber and Data Protection Act [Chapter 12:07].

The Act establishes a framework for the protection of personal information and the secure use of information and communication technologies. It also provides for the establishment of a Data Protection Authority and addresses aspects of cybercrime.

The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is designated as the country’s Data Protection Authority.

This means that businesses processing personal information need to consider more than the technical security of their systems. They must also consider how personal information is collected, why it is processed, who has access to it and whether the organisation is meeting its legal obligations.

The legislation is relevant to businesses of different sizes and across different industries, including retail, education, healthcare, financial services, hospitality, telecommunications and professional services.

The important point is that collecting customer information creates responsibilities. A business cannot assume that it is exempt simply because it is small or operates mainly online.

What Is Personal Information Under Zimbabwean Law?

Personal information generally refers to information relating to an identifiable individual.

The Act’s definition covers a broad range of information that could identify a person directly or indirectly.

Examples include:

• Full names.
• Residential or business contact details linked to an individual.
• Telephone numbers and email addresses.
• National identification information.
• Financial and employment history.
• Educational records.
• Healthcare information.
• Opinions relating to an identifiable individual.
• Other information that can be used to identify someone.

Some information receives additional protection because of its sensitive nature. This includes categories such as health information, genetic information, religious beliefs, political opinions and other information identified as sensitive under the legislation.

For example, a school may collect pupils’ names, parents’ contact details, academic records and medical information. A retailer may collect customer names, delivery addresses and payment-related information. A medical practice may process highly sensitive patient records.

All these organisations need to understand what information they hold and how it is handled.

Who Must Comply With the Cyber and Data Protection Act?

The Act is relevant to organisations and individuals that process personal information within its scope.

This includes businesses that:

• Collect customer information through websites.
• Maintain employee records.
• Store supplier and client contact information.
• Operate online registration systems.
• Process financial or educational records.
• Manage customer databases.
• Provide digital services that involve personal information.
• Share personal information with third-party service providers.

A company does not need to be a large technology organisation to handle personal information.

Consider a small Harare-based construction company. It may collect customer names, telephone numbers, addresses, employee records and supplier information. Even though it is not a bank or technology company, it still needs to understand its responsibilities when processing personal information.

A business should assess its actual activities rather than assuming that data protection law only applies to large corporations.

Data Controller vs Data Processor: What Is the Difference?

Understanding the difference between a data controller and a data processor is one of the most important parts of the legislation.

These terms describe different responsibilities in the handling of personal information.

What Is a Data Controller?

A data controller is a person or organisation that determines the purposes and means of processing personal information.

In simpler terms, the controller decides why information is being collected and how it will be used.

For example, a school that collects pupil information to manage enrolment, attendance and academic records will generally act as a data controller for those activities.

Similarly, a retailer that collects customer details to process orders and manage its customer database will generally be the controller of that information.

The controller has important responsibilities for ensuring that personal information is handled in accordance with the law.

What Is a Data Processor?

A data processor processes personal information on behalf of a data controller and according to the controller’s instructions.

For example, a company may use an external service provider to host its website or maintain a database containing customer information.

Depending on the actual arrangement, that service provider may act as a data processor.

Other examples may include:

• Cloud hosting providers.
• External payroll service providers.
• Customer relationship management providers.
• Email service providers.
• Third-party data management platforms.

The distinction matters because the organisation deciding why information is collected does not necessarily perform every technical operation involving that information.

A controller should understand which third parties handle its information and establish appropriate contractual and security arrangements with them.

What Is a Data Controller Licence in Zimbabwe?

One of the significant developments in Zimbabwe’s data protection framework is the introduction of data controller licensing requirements.

These requirements were set out in the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024, published as Statutory Instrument 155 of 2024.

The regulations establish circumstances in which a person processing personal information must obtain a data controller licence from the Data Protection Authority.

In particular, the regulations address organisations that determine the purposes and means of processing personal information, including processing intended to obtain commercial gain or another benefit.

Businesses should therefore assess whether their activities require licensing rather than assuming that ordinary customer database management is automatically exempt.

Data Controller Licence Categories

SI 155 of 2024 provides four licence tiers based on the number of data subjects whose information is processed.

Licence category	Number of data subjects
Tier 1	50–1,000
Tier 2	1,001–100,000
Tier 3	100,001–500,000
Tier 4	More than 500,000

The regulations also provide for licensing fees.

The published fee schedule specifies:

Licence category	Initial / renewal fee
Tier 1	$50
Tier 2	$300
Tier 3	$500
Tier 4	$2,500

Tier 2, Tier 3 and Tier 4 applications also have a separate application fee of $30.

These are the amounts in the published SI 155 of 2024 fee schedule. Organisations should confirm the current fees, payment arrangements and applicable licensing requirements directly with POTRAZ before submitting an application.

The regulations provide for annual licence validity and renewal. Businesses should therefore treat licensing as an ongoing compliance responsibility rather than a one-time administrative exercise.

Certain activities are exempt from licensing under the regulations, including processing for personal, family or household affairs, law enforcement, and journalistic, historical or archival purposes, subject to the conditions specified in the regulations.

An organisation should not assume it qualifies for an exemption without checking the actual provisions.

What Is a Data Protection Officer (DPO)?

A Data Protection Officer is an individual appointed to oversee and support an organisation’s compliance with data protection requirements.

SI 155 of 2024 requires a data controller to appoint a Data Protection Officer and notify the Data Protection Authority.

The regulations also provide a 90-day appointment period from their promulgation, or following the termination of a DPO’s contract.

The role is not simply to act as a name on a registration form. A DPO has responsibilities involving the organisation’s data protection practices.

These include:

• Monitoring compliance with the Act and regulations.
• Managing internal data protection activities.
• Raising awareness among employees.
• Training staff on data protection.
• Conducting internal compliance audits.
• Responding to requests from the Authority and data subjects.
• Advising on data protection impact assessments.
• Acting as a contact point for data subjects.

The regulations identify relevant experience and qualifications in areas such as data science, information security, information systems audit, law and other relevant fields. They also require an approved DPO certification course.

For businesses without an appropriately qualified internal employee, appointing a suitable professional may require additional planning.

A company should also ensure that its DPO has the information, authority and access needed to perform the role effectively.

What Security Measures Must Businesses Put in Place?

Data protection is not achieved by writing a privacy policy and placing it on a website.

Organisations need appropriate technical and organisational safeguards to protect the personal information they process.

SI 155 of 2024 specifically addresses the security of data. It identifies measures such as risk assessments, organisational policies, technical and physical safeguards, and processes for testing the effectiveness of security controls.

In practical terms, businesses should consider the following areas.

1. Access Control

Not every employee needs access to every customer record.

A business should establish permissions based on job responsibilities. Employees should only access information necessary for their work.

For example, a receptionist may need access to appointment information, while a finance employee may need access to billing records. Neither necessarily needs unrestricted access to the entire customer database.

Strong authentication and multi-factor authentication should also be considered for important business systems.

2. Encryption and Secure Connections

Encryption helps protect information from unauthorised access.

Businesses should use appropriate encryption when information is transmitted and, where suitable, when it is stored.

Websites that collect personal information should use properly configured HTTPS connections.

For online systems, secure connections help protect information as it moves between the visitor’s device and the website.

3. Regular Backups

Backups are an important part of protecting information availability.

If a server fails, ransomware affects business files or an application becomes corrupted, reliable backups can help an organisation recover.

However, backups must be tested. A company that has never verified whether its backups can actually be restored may discover too late that its recovery arrangements are inadequate.

Important backups should also be protected from unauthorised access and, where appropriate, isolated from the systems they are intended to restore.

4. Malware and Endpoint Protection

Employee computers, servers and mobile devices may contain access to customer information.

Malware protection, software updates, endpoint monitoring and appropriate device controls can help reduce the risk of compromise.

A business should know which devices are authorised to access its systems and whether those devices receive security updates.

5. Website and Application Security

Websites can collect substantial amounts of personal information through registration forms, contact forms, customer accounts and online transactions.

Organisations should keep website software updated, remove unused plugins, secure administrator accounts and monitor suspicious activity.

A Web Application Firewall can provide an additional layer of protection against certain malicious requests.

Cloudflare-based services, for example, can help filter malicious traffic before it reaches a protected website. They should be used alongside secure application development, updates and other safeguards.

6. Staff Awareness and Training

Employees can unintentionally expose information through phishing emails, weak passwords, accidental disclosure or unsafe handling of documents.

Regular awareness training helps employees understand their responsibilities.

Staff should know how to recognise suspicious messages, report potential security incidents and handle customer information appropriately.

Security is not only a technical responsibility. It is also an organisational responsibility.

What Happens If a Business Experiences a Data Breach?

A personal data breach can occur when personal information is accessed, disclosed, altered, lost or otherwise compromised without authorisation.

Examples include:

• A customer database being accessed by an attacker.
• Employee records being exposed.
• A laptop containing customer information being stolen.
• A website being compromised and personal information copied.
• An email containing sensitive information being sent to the wrong recipient.

A breach should not be ignored simply because the business believes the incident has been contained.

The organisation needs to establish what happened, which information was affected, whose information may be involved and what steps are required.

Zimbabwe’s Data Breach Notification Requirements

SI 155 of 2024 sets out specific notification requirements.

Under section 17 of the regulations:

• A data controller must report personal data breaches to the Authority within 24 hours of becoming aware of the breach.
• The prescribed Data Breach Notification Form DP3 is used for reporting.
• Where the breach is likely to create a high risk of adversely affecting individuals’ rights and freedoms, the affected data subjects must also be informed within 72 hours.
• The controller must maintain breach detection, investigation and internal reporting procedures.
• Records of personal data breaches must be maintained.

The regulations also set out further requirements for cooperating with the Authority, responding to information requests and completing investigations.

These timelines make preparation important.

A business should not wait until a breach occurs to decide who is responsible for investigating it, who contacts the regulator or how affected individuals will be notified.

An incident response plan should already exist.

What About Businesses That Store Data Outside Zimbabwe?

Many organisations use international hosting providers, cloud applications, email platforms and customer management systems.

This raises an important question: what happens when personal information is stored or processed outside Zimbabwe?

The Cyber and Data Protection framework addresses cross-border transfers and requires organisations to pay attention to the handling and transfer of personal information.

SI 155 of 2024 specifically requires data controllers to notify the Authority of an intention to transfer or share information about data subjects outside Zimbabwe.

Businesses should therefore understand where their data is stored, which service providers can access it and what contractual and legal arrangements apply.

For example, a Zimbabwean company may use an international cloud platform to store customer records. It should understand the platform’s data handling arrangements rather than assuming that the location of its office determines where all its information is processed.

Before selecting a cloud provider, organisations should review its security controls, access arrangements, contractual terms and relevant data protection provisions.

What Are the Risks of Ignoring Data Protection Responsibilities?

Failing to take data protection seriously can create legal, financial and operational consequences.

Regulatory Consequences

The Act and its regulations establish offences and penalties for certain forms of non-compliance.

SI 155 of 2024, for example, sets out penalties relating to licensing failures, DPO appointment failures and breaches of specified security and notification requirements.

The applicable consequences depend on the particular provision and circumstances.

Businesses should not rely on informal assumptions about enforcement or believe that a small organisation will automatically be overlooked.

Loss of Customer Trust

Customers share personal information because they expect an organisation to handle it responsibly.

If a business exposes customer records or mishandles sensitive information, its reputation can suffer.

Customers may become reluctant to use its services, submit online enquiries or continue an existing relationship.

Financial and Operational Disruption

A data breach can require technical investigation, system recovery, legal advice, customer communication and operational changes.

A business may also need to replace compromised credentials, review third-party access and rebuild affected systems.

The costs can extend well beyond the initial technical problem.

Damage to Business Relationships

Companies that work with corporate clients, international partners or regulated organisations may be asked to demonstrate how they protect information.

Weak data protection practices can make it harder to win contracts or maintain important commercial relationships.

For growing Zimbabwean businesses, good information security is increasingly part of demonstrating that an organisation is professionally managed.

A Practical Data Protection Checklist for Zimbabwean Businesses

Understanding the legislation is the first step. Businesses also need to turn its requirements into everyday processes.

The following checklist provides a practical starting point.

• Identify the personal information your organisation collects.

• Document why each category of information is collected.

• Identify whether your organisation acts as a data controller, processor or both for different activities.

• Assess whether your activities require a data controller licence.

• Check the applicable licence tier and current POTRAZ requirements.

• Appoint and notify a suitably qualified Data Protection Officer where required.

• Review your privacy notices and data handling policies.

• Restrict employee access to personal information.

• Implement appropriate technical and organisational security controls.

• Review hosting providers, cloud platforms and other third-party processors.

• Establish written data processing agreements where required.

• Review cross-border data transfers and notification obligations.

• Train employees on responsible information handling.

• Create a documented data breach response procedure.

• Test backups and recovery arrangements.

• Review compliance regularly and keep appropriate records.

This checklist is not a complete legal compliance assessment. Each organisation should review its own processing activities and obtain professional guidance where necessary.

How Tremhost Helps Businesses Strengthen Their Data Security

Data protection requires both organisational processes and appropriate technical safeguards.

A business may have the right policies but still operate an exposed website. Another may have strong firewalls but no clear process for controlling employee access to personal information.

Tremhost provides hosting, cloud infrastructure and cybersecurity services that can support the technical side of a business’s information security programme.

Its cybersecurity portfolio includes services covering different parts of an organisation’s digital environment.

Website Security With Tremhost Armor Guard

Armor Guard provides managed Cloudflare Pro-based website protection.

It helps businesses implement website firewall controls, DDoS protection, SSL/TLS configuration, DNS assistance and monitoring.

This can support organisations that collect customer information through websites and want an additional layer of protection in front of their hosting infrastructure.

Explore: https://tremhost.com/armorguard/

Advanced Website Protection With Armor Shield

Armor Shield is designed for businesses that need Cloudflare Business-grade website protection.

It is particularly relevant to websites that process payments or handle customer information and require more advanced security controls.

Explore: https://tremhost.com/armorshield/

Endpoint Protection With ESET Security

Employee computers and servers can provide access to important business information.

Tremhost offers ESET endpoint security products for organisations looking to strengthen protection across their devices.

Explore: https://tremhost.com/eset-security

Managed Cybersecurity Services

For organisations that want broader technical security management, Tremhost offers managed cybersecurity packages covering areas such as website protection, email security, endpoint security, vulnerability scanning and other agreed security controls.

Explore: https://tremhost.com/managedsecurity

Data Protection at Tremhost

Businesses can also learn more about Tremhost’s approach to data protection and information security through its dedicated page.

Explore: https://tremhost.com/data-protection-at-tremhost/

It is important to understand the distinction between technical security support and legal compliance. Purchasing a firewall, antivirus licence or managed security package does not automatically make an organisation compliant with the Cyber and Data Protection Act.

The organisation remains responsible for assessing its legal obligations, maintaining appropriate policies, appointing required personnel and managing its data processing activities.

Tremhost’s role is to help businesses strengthen the technical safeguards that form part of a wider security programme.

Final Thoughts: Data Protection Should Be Part of How Every Business Operates

Customer information is an important business asset, but it also comes with responsibilities.

Zimbabwe’s Cyber and Data Protection Act provides a framework for protecting personal information and strengthening trust in the country’s digital environment. The regulations introduce practical requirements that businesses need to understand, including licensing, DPO appointments, security safeguards and breach notifications.

For organisations that collect customer details, maintain employee records, operate websites or use cloud platforms, the time to review data protection practices is now.

Do not wait for a compromised database, customer complaint or regulatory enquiry before finding out how your information is handled.

Start by understanding what data your organisation holds, who can access it, where it is stored and what would happen if it were exposed.

Then build the policies, technical controls and responsibilities needed to protect it.

Tremhost helps businesses strengthen the security of their websites, systems and digital infrastructure. Explore the cybersecurity services at https://tremhost.com/managedsecurity and take a more proactive approach to protecting your business information.

Frequently Asked Questions

What is the Cyber and Data Protection Act in Zimbabwe?

The Cyber and Data Protection Act, 2021, Chapter 12:07, is Zimbabwean legislation that provides a framework for data protection, cybersecurity and certain technology-related offences. It establishes the legal framework for the protection of personal information and designates POTRAZ as the Data Protection Authority.

Who is responsible for data protection in Zimbabwe?

The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is designated as the Data Protection Authority under the Act.

Do businesses in Zimbabwe need a data controller licence?

Businesses that determine the purposes and means of processing personal information may be required to obtain a data controller licence under SI 155 of 2024. Specific exemptions apply, so organisations should assess their activities against the regulations and POTRAZ guidance.

What is the difference between a data controller and a data processor?

A data controller determines why and how personal information is processed. A data processor handles personal information on behalf of a controller and according to the controller’s instructions.

Is a Data Protection Officer mandatory in Zimbabwe?

SI 155 of 2024 requires a data controller to appoint a Data Protection Officer and notify the Authority. The DPO must meet the relevant qualification and certification requirements set out in the regulations and applicable guidance.

How quickly must a data breach be reported in Zimbabwe?

Under section 17 of SI 155 of 2024, a data controller must report a personal data breach to the Authority within 24 hours of becoming aware of it. Where the breach is likely to create a high risk to individuals’ rights and freedoms, affected data subjects must also be informed within 72 hours.

Does using Cloudflare make my business compliant with the Data Protection Act?

No. Cloudflare can provide useful website security and performance controls, but it does not fulfil every legal or organisational data protection requirement. Businesses must also address licensing, policies, access controls, staff responsibilities, data processing arrangements and other applicable obligations.

Does a small business need to worry about data protection?

Yes. Small businesses may collect customer details, employee records, supplier information and other personal data. Their size alone does not automatically exempt them from the legal framework.

Does storing information with an international hosting provider remove my responsibilities?

No. Businesses must consider their responsibilities when personal information is processed or transferred outside Zimbabwe. They should understand their providers’ data handling arrangements and check the relevant legal and regulatory requirements.