Sidumisile Mabena
Sikhumbuzo Moyo
THE Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) has urged organisations and individuals handling personal data to comply with the Cyber and Data Protection Act.
The call follows the promulgation of the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024), which made it mandatory for all data controllers to obtain licences.
Under the regulations, natural and legal persons who process personal data were required to secure a Data Controller Licence by March 12, 2025.
In a statement, POTRAZ director general Gift Machengete said entities yet to comply must urgently regularise their operations to avoid penalties prescribed under the law.
“The licensing framework is a critical component in ensuring accountability and transparency in the handling of personal data. All data controllers are required to comply with the provisions of the Act,” said Dr Machengete.
He said the appointment of Data Protection Officers was also a legal requirement, as they are tasked with ensuring adherence to data protection principles and safeguarding personal information.
“POTRAZ has noted with concern that some organisations continue to process personal data without the requisite licence, despite the lapse of the March 2025 compliance deadline. All such entities are required to regularise their data processing activities with immediate effect by applying for an initial Data Controller licence or renewing their existing licence,” reads part of the notice published on POTRAZ’s social media platforms.
Non-compliance exposes organisations to legal sanctions, as Government steps up efforts to enforce data protection and privacy standards.
The Cyber and Data Protection Act was enacted to strengthen the protection of personal data, curb misuse of information, and align Zimbabwe with global best practices on privacy and data security.
Online Reporter