Astertax was represented at the national stakeholder consultation hosted by POTRAZ from 20-25 September in Nyanga.
Over the past five years, Zimbabwe has moved from establishing a legal framework for data protection towards a more active regulatory environment.
From legislation to implementation
The foundation was laid in 2021 with the enactment of the Cyber and Data Protection Act [Chapter 12:07].
The Act established the framework for protecting personal information and set out rights and obligations relating to the processing of personal data.
In 2024, the framework moved another step forward with the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (S.I. 155 of 2024). The Regulations introduced more specific requirements relating to data controller licensing and the appointment of Data Protection Officers.
The next stage was implementation. 12 March 2025 marked the registration deadline communicated for data controllers. The focus was no longer simply on establishing the law, but on bringing organisations into the regulatory framework.
POTRAZ also developed practical guidance covering areas including Data Protection Officers, children’s personal information, data breach notification, consent, cross-border transfers and licensing.
The conversation was beginning to move beyond:
“What does the law say?”
to:
“What does compliance look like in practice?”
2026: Moving towards stricter regulatory enforcement
We are now entering another phase. POTRAZ Regulatory Notice 2 of 2026 provides for a data protection compliance assessment exercise commencing on 1 September 2026. This signals an important development in Zimbabwe’s regulatory journey, a move towards more active oversight of how organisations are implementing their data protection obligations.
For businesses, this means that data protection is increasingly becoming an ongoing organisational responsibility, rather than a once-off registration exercise.
Zimbabwe’s data protection framework will continue to evolve as implementation progresses and organisations become increasingly reliant on digital technologies. Cloud services, artificial intelligence, digital platforms and third-party service providers are changing the way businesses collect, use, share and store personal information. The regulatory framework will therefore need to continue evolving alongside these developments.
The journey so far can broadly be understood as:
2021 — Legislation
↓
2024 — Licensing and DPO requirements
↓
2025 — Registration and implementation
↓
2026 — Regulatory oversight and compliance assessment
↓
The next chapter — continued development of the regulatory framework
For organisations processing personal information, the direction of travel is clear.
Data protection is moving beyond registration towards ongoing compliance, accountability and regulatory oversight.
The question is no longer simply:
“Are we registered?”
It is increasingly:
“How are we demonstrating compliance?”
The stakeholder consultation in Nyanga was a timely reminder that Zimbabwe’s data protection framework is continuing to develop.
What should be expected?
Zimbabwe’s data protection framework will continue to develop as regulatory implementation progresses and new technologies create new questions for regulators and organisations.
Data controllers should continue to monitor regulatory developments and upcoming regulatory guidance in areas including artificial intelligence, direct marketing, special categories of personal data, cybersecurity, data subject requests and other areas requiring further regulatory guidance.
The important point is that organisations should not wait for the regulator to take enforcement action, but should strive to achieve voluntary regulatory compliance. Compliance is no longer a future goal it is an immediate operational necessity as the regulator is also working on administrative fines for offences such as failure to notify the authority before initiating cross border data transfers, failure to appoint a DPO, and failure to uphold data subjects rights.
What began with the establishment of a statutory framework has evolved into a regulatory environment increasingly focused on implementation, accountability and demonstrable compliance.