If your website collects personal information, through contact forms, orders, accounts or newsletters, the Act treats you as a data controller: you must tell people what you do with their data, keep it secure and report breaches to POTRAZ within 24 hours. Under S.I. 155 of 2024 you may also need a data controller licence from POTRAZ and a data protection officer.
General information, not legal advice, as at November 2026. It is based on the Cyber and Data Protection Act [Chapter 12:07] (text on ZimLII) and S.I. 155 of 2024, the regulations on licensing data controllers and appointing data protection officers. POTRAZ is the Data Protection Authority. For your own situation, ask POTRAZ or a lawyer.
What the Act asks of your website
- Tell people when you collect their data (section 15). At each form, or in a notice linked from it, give at least your name and address, why you are collecting the data, whether answering is compulsory and what happens if they don't, who receives the data, their right to see and correct it, and their right to object, free of charge, to direct marketing.
- Have a basis for using it (section 10). Usually that is consent, which can be implied for adults with full legal capacity; the exceptions include a legal obligation and legitimate interests. Sensitive data, such as health information, needs consent in writing (section 11). Under S.I. 155, children's data needs a parent's or guardian's consent.
- Respect people's rights (section 14) to be informed, to see their data, to object, and to have it corrected, or deleted if it is false or misleading.
- Keep it secure (section 18) with appropriate technical and organisational measures, and have a written contract with anyone who processes data for you.
- Report breaches to POTRAZ within 24 hours of becoming aware of them (section 19). S.I. 155 adds that where a breach poses a high risk, you inform the people affected within 72 hours.
Your data is hosted outside Zimbabwe
Tremhost has no data centre in Zimbabwe. Our servers are in Johannesburg, New York, Miami, Limburg and Roubaix, and shared hosting and email run on our servers in Europe and the USA. Sections 28 and 29 of the Act allow personal data to be transferred abroad only where adequate protection is ensured, or under exceptions such as the person's unambiguous consent. Say in your privacy notice where the data is stored. If you need a set location, a VPS or dedicated server lets you choose one, with Johannesburg the nearest: see Data centres.
Licences and data protection officers
Under S.I. 155, anyone who decides why and how personal data is processed applies to POTRAZ for a data controller licence on Form DP1, unless exempt (for example, purely personal or household use). POTRAZ responds within 14 days. A licence lasts 12 months; apply to renew at least three months before it expires. The tier depends on how many people's data you process:
| Tier | Data subjects | Application fee | Licence fee |
|---|---|---|---|
| 1 | 50 to 1,000 | None listed | USD 50 |
| 2 | 1,001 to 100,000 | USD 30 | USD 300 |
| 3 | 100,001 to 500,000 | USD 30 | USD 500 |
| 4 | More than 500,000 | USD 30 | USD 2,500 |
Source: S.I. 155 of 2024, section 6 and Second Schedule. Fees are payable in US dollars or ZiG.
A data controller must also appoint a data protection officer and notify POTRAZ in writing on Form DP2, and report a change of officer within 14 days. The officer needs relevant skills or experience (such as law, audit, information security or data analytics), knowledge of Zimbabwe's data protection law, and a certification course approved by POTRAZ. S.I. 155 gave existing controllers six months to apply for a licence and 90 days to appoint an officer, counted from its publication in September 2024; those periods have passed. Most failures to comply are offences, punishable by a fine, imprisonment or both.
Cookies
Neither the Act nor S.I. 155 mentions cookies. A clear cookie notice is still good practice: see How do I add a privacy policy and cookie notice to my site?
A quick checklist
- List every place your site collects personal data: forms, orders, accounts, newsletters and analytics.
- Add a short notice at each form, and a privacy policy linked from every page.
- Use HTTPS, keep WordPress and plugins updated, and keep backups: see force HTTPS and update WordPress safely.
- Work out your tier, apply for a licence and appoint a data protection officer.
- Write down who does what if there is a breach, so you can report it within 24 hours.
How we handle the data on our servers is set out in Data protection at Tremhost. For help with compliance, see Compliance.
Updated 6 November 2026. Something here out of date? Tell us.