Zimbabwe

Regulator: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ, designated Data Protection Authority) ↗
Law: Cyber and Data Protection Act [Chapter 12:07] of 2021 (SI 155/2024 licensing regulations) ↗
Status: Enforces without publishing
Authority: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ, designated Data Protection Authority), established 2021

in force

DP law status

Cyber and Data Protection Act [Chapter 12:07] of 2021 (SI 155/2024 licensing regulations)

Yes

enforcement activity

as of the last landscape verification

decisions published

no public record to collect

The law

Cyber and Data Protection Act [Chapter 12:07], 2021 (Act 5 of 2021) IN FORCE

commenced 2021-12-03 · Official full text ↗

Scope: Processing of data wholly or partly in Zimbabwe; combines data protection with cybercrime provisions.
Key obligations: Controller licensing under SI 155/2024 (deadline 12 Mar 2025; annual renewal); DPO appointment and notification to POTRAZ (Form DP2, by 12 Dec 2024); Applies to entities processing data of 50+ individuals
DPO required: Yes: qualified DPO mandatory under SI 155/2024.
Registration: Yes: licence from POTRAZ; unlicensed processing an offence (fine + up to 7 years).
Cross-border transfers: Transfers restricted; authorisation/adequacy conditions apply.
Breach notification: 24 hours to POTRAZ under SI 155/2024: the tightest breach deadline on the continent.
Penalties: Criminal fines and imprisonment (up to level 11 fines; up to 7 years for unlicensed processing).
Authority: POTRAZ (designated Data Protection Authority)

Verified 2026-07-06

Access to information

Freedom of Information Act 2020 IN FORCE

The regulator

Authority: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ, designated Data Protection Authority)
Website: https://www.potraz.gov.zw ↗
Established: 2021
Operational: Yes
Enforcing: Yes
Publishes decisions: No

Enforcement record

Enforcement activity is documented for this jurisdiction, but the authority does not publish its decisions. The tracker records only what can be verified against a public document, so no decision pages exist here; the publication gap itself is measured in Enforcement in the Dark.

Track Zimbabwe

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.