How to Apply for a Data Controller License in Zimbabwe – CDPA Step-by-Step Guide?

Learn how to apply for a Data Controller License in Zimbabwe under the Cyber and Data Protection Act

Introduction

Under Zimbabwe’s Cyber and Data Protection Act (CDPA), organizations or businesses that collect, process, or store personal data are required to register as Data Controllers with POTRAZ. A Data Controller License ensures your organization is legally recognized and compliant with data protection regulations.

1. Who Needs a Data Controller License?

Any business, NGO, or institution that collects or processes personal data in Zimbabwe.

Includes: e-commerce platforms, mobile apps, health providers, schools, banks, and social media platforms operating in Zimbabwe.

Small businesses handling minimal data may still need to register to stay compliant.

2. Key Requirements Before Applying

Business registration documents: Certificate of incorporation or registration with the relevant authority.

Physical address of the organization.

Data protection policies outlining how personal data will be collected, stored, and processed.

Responsible officer: Name and details of the person in charge of data protection (Data Protection Officer if applicable).

IT Security Measures: Systems to secure personal data.

3. Step-by-Step Application Process

Step 1: Prepare Required Documents

Business registration certificate

National ID or passport of the business owner / responsible officer

Data protection policy and IT security measures documentation

Contact details and organizational address

Step 2: Access the POTRAZ Application

Visit the official POTRAZ website: https://www.potraz.gov.zw

Navigate to the Data Controller License Application section.

Step 3: Complete the Online Form

Fill in organization name, type, address, and contact details.

Provide details of the responsible officer (name, ID, contact).

Upload required supporting documents.

Step 4: Pay the Application Fee

Fees vary depending on the size and type of business.

Payment can usually be done via EcoCash, bank transfer, or POTRAZ-approved methods.

Step 5: Submit the Application

After uploading documents and paying the fee, submit the application online.

You will receive a confirmation receipt with an application number.

Step 6: Wait for Review and Approval

POTRAZ reviews applications for completeness and compliance.

Additional information may be requested.

Once approved, you will receive a Data Controller License certificate.

4. Compliance Tips After Receiving License

Ensure all personal data collection follows your approved data protection policy.

Update POTRAZ on any changes in organization structure or responsible officer.

Conduct regular data audits and security checks.

Train staff on CDPA compliance and best practices.

5. Penalties for Non-Compliance

Operating without a Data Controller License can result in:

Fines ranging from thousands to millions of Zimbabwean dollars

Legal action or prosecution under the CDPA

Possible suspension of business operations