Online Reporter
Ivan Zhakata
Herald Correspondent
THE Postal and Telecommunications Regulatory Authority of Zimbabwe has licensed 880 data controllers under the Cyber and Data Protection Act [Chapter 12:07] as part of ongoing efforts to strengthen the protection of personal information.
In an interview, POTRAZ Director-General Dr Gift Machengete said the move demonstrated the growing commitment of organisations to comply with Zimbabwe’s data protection framework.
“The licensing of 880 data controllers is a clear indication that organisations are beginning to take data protection obligations seriously,” he said.
“The Cyber and Data Protection Act signalled Zimbabwe’s commitment to ensuring that the processing of personal data is lawful, secure and respectful of the rights of data subjects, while at the same time enabling innovation and digital transformation.”
The Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024) require all entities that process personal data to register and obtain licences and to appoint certified Data Protection Officers (DPOs).
Full compliance with the law was expected by March 2025, but it was extended.
Dr Machengete said POTRAZ was piloting an electronic licensing system to make the registration process more efficient and transparent.
Selected data controllers are currently testing the platform.
In addition to licensing, POTRAZ has rolled out nationwide awareness campaigns and training programmes.
Since 2023, the Authority has conducted more than 50 public outreach initiatives across schools, communities and institutions and 46 in-house training sessions for executives and managers.
Through a partnership with the Harare Institute of Technology (HIT), POTRAZ has trained 1 026 DPOs, including participants from Malawi, Eswatini and Botswana, strengthening regional compliance capacity.
“Data protection is ultimately about people. By equipping DPOs with the right knowledge and practical skills, we are embedding a culture of privacy and cybersecurity across sectors and borders,” Dr Machengete said.
Despite progress, challenges remain.
Some organisations are yet to register their data controllers and gaps persist in appointing certified DPOs, leaving personal data exposed to potential risks.
POTRAZ is reportedly preparing new regulations introducing civil sanctions to enhance enforcement.
“These gaps undermine the effectiveness of the framework. That is why enforcement, guidance and training must move hand in hand,” Dr Machengete said.
Zimbabwe’s data protection regime, enacted in 2021, continues to evolve as the country seeks to balance digital innovation with citizen privacy and cybersecurity.
