Regulations › Rest of world › Zimbabwe
CDPA (Zimbabwe)
Cyber and Data Protection Act, 2021 (Zimbabwe)
WhenGazetted in December 2021; licensing regulations (SI 155 of 2024) followed
Who enforces itPOTRAZ, as Data Protection Authority
Who it applies toData controllers processing personal data in Zimbabwe.
Tell the regulatorNotify POTRAZ within 24 hours of becoming aware, on Form DP3
DPO requiredEvery data controller must appoint a DPO and notify POTRAZ on Form DP2
RegistrationControllers processing data of 50 or more people need a POTRAZ licence, tiered USD 50-2,500, r…
Transfers abroadTransfers abroad need adequate protection in the recipient country or a listed derogation such…
Request deadlineNo fixed response deadline in the Act or SI 155
Maximum fineFines up to level 11 (reported at about USD 1,000) and/or up to 7 years' imprisonment
Data protection authority Postal and Telecommunications Regulatory Authority of Zimbabwe, as Data Protection Authority (POTRAZ)
- Website
- potraz.gov.zw
Contact details still to be confirmed with POTRAZ.
Checked 18 Oct 2026. Report a change
Local help in Zimbabwe
Law firms, training centers and other providers in Zimbabwe can apply to be listed here. We check each one before it shows.
List your organizationRegulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws