Personal information has become one of the most valuable assets organisations handle. Businesses collect customer details, schools maintain learner records, hospitals process patient information and financial institutions manage sensitive financial data.<\/p>\n
But who is responsible for ensuring that this information is handled properly?<\/p>\n
In Zimbabwe, the Data Protection Officer (DPO) plays an important role in helping organisations meet their obligations under the Cyber and Data Protection Act [Chapter 12:07] and its associated regulations.<\/p>\n
The role is particularly important as organisations increasingly depend on digital platforms, cloud services, online payments, customer databases and electronic communication.<\/p>\n
For businesses, appointing a Data Protection Officer is not simply about adding another position to the organisation. It is about establishing accountability for how personal information is collected, stored, accessed, shared and protected.<\/p>\n
In this guide, we explain what a Data Protection Officer does, the qualifications required, how appointment works in Zimbabwe and what organisations should understand about their legal responsibilities in 2026.<\/p>\n
A Data Protection Officer is an individual appointed by a data controller to oversee and support compliance with applicable data protection requirements.<\/p>\n
Under Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07], a DPO is responsible for ensuring, in an independent manner, that the organisation complies with its obligations under the Act.<\/p>\n
The DPO helps an organisation understand its data protection responsibilities and establish appropriate internal practices.<\/p>\n
This may involve reviewing how personal information is collected, advising employees, coordinating compliance activities, supporting investigations and serving as a point of contact for data subjects and the Data Protection Authority.<\/p>\n
For example, consider a company in Harare that operates an online retail platform.<\/p>\n
The company collects customers’ names, telephone numbers, delivery addresses and payment-related information. It also stores employee records and shares certain information with third-party service providers.<\/p>\n
A Data Protection Officer helps oversee how these activities are conducted and whether appropriate safeguards and procedures are in place.<\/p>\n
The DPO’s role is not limited to responding when something goes wrong. It also involves helping the organisation prevent problems through proper policies, awareness and ongoing compliance oversight.<\/p>\n
Yes. Zimbabwe’s Statutory Instrument 155 of 2024 requires a data controller to appoint a Data Protection Officer and notify the Data Protection Authority in writing.<\/strong><\/p>\n This requirement is set out in section 12 of the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024.<\/p>\n The regulation states that:<\/p>\n The regulation also establishes an offence for failure to appoint a DPO, carrying a penalty of a fine not exceeding level 7, imprisonment for up to two years, or both.<\/p>\n The requirement is therefore a formal regulatory obligation, not merely a recommendation for large companies.<\/p>\n The relevant legislation is available here:<\/p>\n Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 \u2013 SI 155 of 2024<\/a><\/p>\n The appointment requirement applies to data controllers under the applicable regulations.<\/p>\n A data controller is an individual or organisation that determines the purposes and means of processing personal information.<\/p>\n In practical terms, many organisations that collect and use personal information as part of their operations may fall within this framework.<\/p>\n Examples include:<\/p>\n Banks, microfinance institutions, insurance companies and other financial service providers process customer identification details, financial records and transaction information.<\/p>\n Their data protection responsibilities are particularly important because of the nature and volume of information they handle.<\/p>\n Schools process information about learners, parents, guardians and employees.<\/p>\n This may include admission records, examination results, attendance information, medical details and financial records.<\/p>\n Institutions processing children’s personal information should pay particular attention to the additional safeguards established by SI 155 of 2024.<\/p>\n Hospitals, clinics, medical laboratories and other healthcare organisations handle patient information, including health records.<\/p>\n Health information is treated as sensitive data under Zimbabwe’s data protection framework and requires appropriate protection.<\/p>\n Telecommunications providers process customer identification information, account records and communication-related data.<\/p>\n They should establish appropriate internal oversight and data protection arrangements.<\/p>\n Retailers may collect customer contact details, purchase histories, delivery addresses and information associated with online transactions.<\/p>\n An organisation does not need to be a large technology company to have data protection responsibilities.<\/p>\n Property managers and real estate businesses may process tenant details, identification documents, rental information and financial records.<\/p>\n These activities should be assessed against the applicable licensing and data protection requirements.<\/p>\n Public institutions also process personal information as part of their responsibilities.<\/p>\n They should establish suitable governance and data protection arrangements for the information they handle.<\/p>\n Important:<\/strong> The examples above are not a substitute for determining whether a particular organisation meets the legal definition of a data controller and is subject to licensing or any applicable exemption. Organisations should assess their actual processing activities and consult POTRAZ or qualified legal advisers where necessary.<\/p>\n The responsibilities of a DPO extend beyond checking whether an organisation has a privacy policy.<\/p>\n Section 14 of SI 155 of 2024 sets out the functions of a Data Protection Officer.<\/p>\n These include the following.<\/p>\n The DPO helps monitor whether the organisation is complying with the Cyber and Data Protection Act, its regulations and internal data protection policies.<\/p>\n This involves understanding how the organisation collects, processes, stores and shares personal information.<\/p>\n For example, a DPO working with a school may review how learner records are accessed by teachers, administrators and external service providers.<\/p>\n The objective is to identify practices that may create unnecessary privacy or security risks.<\/p>\n The DPO supports the organisation’s internal data protection programme.<\/p>\n This may involve maintaining compliance records, coordinating internal reviews and helping different departments understand their responsibilities.<\/p>\n The DPO should have a clear understanding of the organisation’s data processing activities.<\/p>\n Employees need to understand that protecting personal information is part of their everyday responsibilities.<\/p>\n The DPO helps promote awareness of appropriate data handling practices.<\/p>\n For example, employees should understand why customer identification documents should not be shared through unauthorised channels or why passwords should never be disclosed to colleagues.<\/p>\n Training is an important part of an organisation’s data protection programme.<\/p>\n The DPO helps ensure that employees understand:<\/p>\n Training should be relevant to employees’ actual responsibilities.<\/p>\n A finance employee may require different practical guidance from someone working in human resources or customer support.<\/p>\n A DPO helps assess whether the organisation’s data protection practices are operating as intended.<\/p>\n An internal review may examine:<\/p>\n These reviews can help management identify weaknesses before they develop into more serious problems.<\/p>\n Individuals have rights under Zimbabwe’s data protection framework.<\/p>\n The DPO helps the organisation deal with relevant requests from individuals and the Data Protection Authority.<\/p>\n This may involve coordinating the retrieval of information, directing requests to the appropriate department and helping ensure that responses are handled properly.<\/p>\n The DPO also serves as an important point of contact for communication with POTRAZ.<\/p>\n Employees may encounter situations where they are unsure whether information can be collected, shared or disclosed.<\/p>\n The DPO provides guidance on the organisation’s obligations and appropriate data handling practices.<\/p>\n For example, a marketing employee may want to use an existing customer database for a new promotional campaign.<\/p>\n The DPO can help assess whether the proposed processing is consistent with the applicable legal requirements and the purpose for which the information was originally collected.<\/p>\n Some processing activities can create significant risks for individuals.<\/p>\n The DPO advises on and monitors Data Protection Impact Assessments (DPIAs).<\/p>\n A DPIA helps an organisation identify and assess potential privacy risks before introducing certain data processing activities.<\/p>\n For example, a school introducing a biometric attendance system should carefully assess the information being collected, the necessity of the system, access arrangements and potential risks to learners.<\/p>\n The DPO helps the organisation engage with POTRAZ in relation to its data protection responsibilities.<\/p>\n This includes responding to relevant enquiries and supporting regulatory engagement.<\/p>\n Individuals should have a clear channel through which they can raise questions or concerns about how their personal information is processed.<\/p>\n The DPO helps provide that contact point and supports the organisation in handling relevant concerns.<\/p>\n Not every employee can automatically be appointed as a DPO.<\/p>\n Section 13 of SI 155 of 2024 establishes the qualification and experience requirements.<\/p>\n A Data Protection Officer should have skills, qualifications or experience in one or more relevant areas, including:<\/p>\n The DPO must also have:<\/p>\n Knowledge of national data protection laws and practices.<\/strong><\/p>\n The individual should understand Zimbabwe’s legal and regulatory framework, including the Cyber and Data Protection Act and applicable regulations.<\/p>\n An understanding of the organisation’s operations.<\/strong><\/p>\n A DPO should understand how the organisation works and how personal information is processed within its different departments.<\/p>\n Approved DPO certification.<\/strong><\/p>\n The regulations require every DPO to undergo a certification course approved by the Data Protection Authority.<\/p>\n This is important because professional experience alone does not remove the certification requirement.<\/p>\n Organisations should verify that the training provider is accredited by the Authority before enrolling their appointed DPO.<\/p>\n The appointment process should be approached as a formal compliance exercise.<\/p>\n Here is a practical outline.<\/p>\n Start by identifying the personal information your organisation collects, uses, stores and shares.<\/p>\n Consider:<\/p>\n Determine whether the organisation qualifies as a data controller under the applicable legislation and regulations.<\/p>\n Select an individual with relevant professional knowledge or experience.<\/p>\n The candidate should understand the organisation’s operations and have the ability to advise different departments on data protection responsibilities.<\/p>\n The role should also be sufficiently independent to allow the DPO to perform the statutory functions without inappropriate interference.<\/p>\n Ensure that the appointed individual completes the required certification course through a provider approved by POTRAZ.<\/p>\n Organisations should confirm current training arrangements, accreditation and applicable fees directly with the Authority.<\/p>\n Document the appointment and establish the individual’s responsibilities.<\/p>\n The organisation should ensure that the DPO has an appropriate reporting arrangement and access to the information necessary to carry out the role.<\/p>\n The appointment must be notified to the Data Protection Authority in writing using Form DP2, as provided in the Third Schedule of SI 155 of 2024.<\/p>\n The form requests details about the data controller and the appointed DPO, including contact and qualification information.<\/p>\n Organisations should obtain the current official form and submission instructions from POTRAZ.<\/p>\n Once appointed, the DPO should begin coordinating the organisation’s internal data protection activities.<\/p>\n This may include reviewing policies, training staff, assessing risks and establishing procedures for responding to data subject requests and security incidents.<\/p>\n If the DPO’s contact information changes, the Authority must be notified within the prescribed 14-day period.<\/p>\n The dismissal or resignation of a DPO must also be reported in writing within 14 days.<\/p>\n The organisation must appoint a replacement within 90 days following termination of the previous DPO’s contract.<\/p>\n Failure to appoint a Data Protection Officer can result in legal consequences.<\/p>\n Section 12(6) of SI 155 of 2024 provides that a data controller who fails to appoint a DPO in accordance with the regulations commits an offence.<\/p>\n The penalty is a fine not exceeding level 7, imprisonment for a period not exceeding two years, or both.<\/p>\n The wider data protection framework also contains separate obligations and penalties relating to licensing, security safeguards and the handling of personal information.<\/p>\n Organisations should therefore avoid treating the DPO appointment as an isolated compliance task.<\/p>\n Appointing a DPO does not automatically resolve every data protection issue. The organisation remains responsible for its own processing activities and compliance obligations.<\/p>\n These roles are related, but they are not the same.<\/p>\n A Data Protection Officer focuses on the organisation’s compliance with data protection requirements and the responsible handling of personal information.<\/p>\n An IT Security Officer focuses more directly on protecting technology infrastructure, systems, devices and networks.<\/p>\n The following comparison illustrates the difference.<\/p>\n In smaller organisations, some responsibilities may overlap. However, the DPO’s independent oversight role should not be confused with the technical responsibility for managing an IT environment.<\/p>\n An organisation may need both functions, even if some operational activities are supported by external service providers.<\/p>\n The key legal requirement is that the data controller appoints a suitable DPO who can perform the required functions.<\/p>\n The provisions of SI 155 of 2024 do not establish a universal full-time employment rule for every organisation.<\/p>\n The appropriate arrangement should be assessed according to the organisation’s size, processing activities, complexity and practical compliance needs.<\/p>\n A business should ensure that its appointed DPO has sufficient time, authority and access to carry out the role effectively.<\/p>\n Where an organisation is considering an external or shared arrangement, it should confirm that the proposed structure satisfies the applicable legal and POTRAZ requirements.<\/p>\n The organisation should not assume that outsourcing responsibility removes its own legal accountability.<\/p>\n Data protection and cybersecurity are closely connected, but they are not identical.<\/p>\n Data protection focuses on the lawful and responsible processing of personal information.<\/p>\n Cybersecurity focuses on protecting systems, networks, devices and information against unauthorised access, attacks and disruption.<\/p>\n A business may have a detailed privacy policy but still operate vulnerable servers, unsecured email accounts and poorly protected computers.<\/p>\n Equally, an organisation may have strong firewalls and antivirus software but collect personal information without appropriate procedures or legal justification.<\/p>\n An effective compliance programme needs both.<\/p>\n For example, consider an organisation that stores customer records on a cloud-based platform.<\/p>\n The DPO may help assess the organisation’s data processing practices, retention arrangements, access requirements and privacy risks.<\/p>\n The cybersecurity team may implement MFA, endpoint protection, secure backups, access restrictions and monitoring.<\/p>\n These activities complement one another.<\/p>\n Appointing a DPO is only one part of the wider legal framework.<\/p>\n The Cyber and Data Protection Act and SI 155 of 2024 establish several other obligations.<\/p>\n SI 155 of 2024 requires qualifying data controllers to apply for a licence from POTRAZ.<\/p>\n The regulations establish four licence tiers based on the number of data subjects:<\/p>\n\n
Which organisations need a Data Protection Officer in Zimbabwe?<\/h2>\n
1. Financial institutions<\/h3>\n
2. Schools and educational institutions<\/h3>\n
3. Healthcare providers<\/h3>\n
4. Telecommunications companies<\/h3>\n
5. Retail and e-commerce businesses<\/h3>\n
6. Property management companies<\/h3>\n
7. Government departments and public institutions<\/h3>\n
What are the responsibilities of a Data Protection Officer?<\/h2>\n
1. Monitoring compliance with data protection legislation<\/h3>\n
2. Managing internal data protection activities<\/h3>\n
3. Raising awareness about data protection<\/h3>\n
4. Training employees<\/h3>\n
\n
5. Conducting internal compliance audits<\/h3>\n
\n
6. Responding to requests from data subjects and the Authority<\/h3>\n
7. Advising employees about their responsibilities<\/h3>\n
8. Advising on Data Protection Impact Assessments<\/h3>\n
9. Working with the Data Protection Authority<\/h3>\n
10. Acting as a contact point for data subjects<\/h3>\n
What qualifications must a Data Protection Officer have in Zimbabwe?<\/h2>\n
\n
How do you appoint a Data Protection Officer in Zimbabwe?<\/h2>\n
Step 1: Assess your organisation’s data processing activities<\/h3>\n
\n
Step 2: Identify a suitable candidate<\/h3>\n
Step 3: Complete the required DPO certification<\/h3>\n
Step 4: Formally appoint the DPO<\/h3>\n
Step 5: Notify POTRAZ using Form DP2<\/h3>\n
Step 6: Establish ongoing compliance activities<\/h3>\n
Step 7: Keep appointment information up to date<\/h3>\n
What happens if an organisation does not appoint a DPO?<\/h2>\n
What is the difference between a Data Protection Officer and an IT Security Officer?<\/h2>\n
\n\n
\n Area<\/th>\n Data Protection Officer<\/th>\n IT Security Officer<\/th>\n<\/tr>\n \n Main responsibility<\/td>\n Data protection oversight<\/td>\n Technology security<\/td>\n<\/tr>\n \n Legal compliance<\/td>\n Advises and monitors data protection compliance<\/td>\n Supports technical security controls<\/td>\n<\/tr>\n \n Privacy policies<\/td>\n Reviews and advises<\/td>\n Supports technical implementation<\/td>\n<\/tr>\n \n Staff awareness<\/td>\n Data protection training<\/td>\n Cybersecurity awareness<\/td>\n<\/tr>\n \n Security incidents<\/td>\n Supports data breach and regulatory processes<\/td>\n Investigates technical security incidents<\/td>\n<\/tr>\n \n Access management<\/td>\n Reviews privacy and access implications<\/td>\n Implements and manages technical access controls<\/td>\n<\/tr>\n \n Regulatory communication<\/td>\n Contact point for data protection matters<\/td>\n Provides technical information when required<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Does a Data Protection Officer need to be a full-time employee?<\/h2>\n
What is the relationship between a DPO and cybersecurity?<\/h2>\n
Data protection requirements every Zimbabwean organisation should understand<\/h2>\n
1. Data controller licensing<\/h3>\n