A current licence.
Issued under SI 155, valid for 12 months, renewed at least three months before expiry.
Data protection compliance for health institutions
POTRAZ will begin inspections on 1 September 2026. We get your institution licensed, with a certified data protection officer and procedures your staff will actually follow.
Why this is urgent now
Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] makes POTRAZ the data protection authority. Statutory Instrument 155 of 2024 sets out licensing. Any organisation that determines the purposes and means of processing personal data must hold a data controller licence, and the tiers begin at 50 data subjects. That covers almost every health institution in the country.
Existing controllers had six months from promulgation to apply. That deadline passed in March 2025. Organisations without a licence are not late; they are in violation.
POTRAZ inspections will begin on 1 September 2026.
What inspectors check
A certified data protection officer.
Appointed, certified, and notified to POTRAZ on Form DP2.
Consent.
How you collect it, and whether your records show it.
Retention and security.
What you keep, for how long, and how it is protected.
Breach notification.
A breach must be reported to POTRAZ within 24 hours of awareness, and affected people told within 72 hours where the risk is high.
Ask your team one question this week: if we discovered a data breach on a Sunday night, who reports it within 24 hours, and how?
What non-compliance carries
Processing without a licence after the transition period carries a fine up to level 11, up to seven years imprisonment, or both. Failing to appoint a data protection officer carries a fine up to level 7, up to two years, or both.
For an organisation holding patient data, the practical risk is an order to stop processing until compliant.
How we help
Readiness check
A written gap assessment against SI 155. You get a data inventory, a gap report, a costed remediation plan and an inspection risk rating. Usually inside two weeks.
Full compliance
Everything needed to get licensed and inspection-ready. Licence application filed, data protection officer appointed and notified, consent forms, privacy notice, retention schedule, breach procedure, security baseline and a staff training session.
Retained data protection officer
We act as your data protection officer on an ongoing basis. Named officer of record, breach response on call, annual licence renewal, quarterly review and staff refreshers.
What we do not do
We are not a law firm. We do not give legal opinions and we do not represent organisations in enforcement proceedings. Where a question is genuinely legal, we say so and you instruct counsel.
We do not certify data protection officers. Certification runs through an Authority-approved course. We prepare your officer and manage the process; the certification is theirs.
Fees payable to POTRAZ are your own cost and are never invoiced through us. We quote them separately so there is no confusion about what you are paying for.
Who we work with
Health implementing partners running facility-level programmes, private hospitals and consultant groups, medical aid societies, diagnostic laboratories, pharmacy groups, and health NGOs and trusts.
Find out where you stand
Twenty minutes on a call, no charge. You will leave it knowing whether you are licensed, what is missing, and what it would take to fix.
Sources
- Cyber and Data Protection Act, 2021 [Chapter 12:07]
- Statutory Instrument 155 of 2024, Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, POTRAZ
- MISA Zimbabwe, Navigating the Data Protection Act Requirements, March 2025
- Veritas, Bill Watch 27/2026, POTRAZ Inspections to Ensure Compliance with Cyber and Data Protection Act, 28 July 2026
Legal position as at 24 October 2026.