Most organisations believe they are more compliant than they are
Having a privacy policy on your website does not make you CDPA compliant. Neither does having IT security controls, or a general understanding of data protection among your team. Genuine compliance needs a structured, documented and operational programme, and most Zimbabwean organisations have significant gaps they are simply unaware of.
- Unknown exposure
- Without an audit you do not know which processing activities are non-compliant, or what your actual risk level is.
- Undocumented practices
- Verbal processes and informal data handling cannot be evidenced to a regulator, auditor or procurement team.
- Missed obligations
- Consent, data subject rights, breach response and third-party agreements are the obligations most routinely overlooked.
An audit is the foundation of every compliance programme
Before you can build or improve a data protection programme you need to know where you stand. A professional gap analysis provides the evidence base for every subsequent decision — which policies to write, which staff to train, which systems need controls, which contracts need updating.
- Satisfies POTRAZ's expectation of documented compliance accountability
- Provides an audit trail for regulatory enquiries
- Supports board reporting on data governance and privacy risk
- Is required by many international clients and procurement frameworks
- Enables targeted, cost-effective investment in compliance improvements
What the audit examines
A comprehensive review of your data processing environment — not just the policies, but what actually happens day to day.
Data inventory review
What personal data you hold, where it comes from, where it goes, and whether the collection is lawful.
Policy and documentation audit
Whether your privacy notice, data protection policy, ROPA and rights procedures are complete and current.
Consent and lawful basis review
Whether each processing activity has a valid legal basis, and whether consent mechanisms are compliant.
Third-party and vendor contracts
Whether your data processing agreements with vendors, partners and processors meet CDPA requirements.
Technical controls assessment
Whether access controls, encryption, backup and incident response are appropriate to the data you hold.
Staff awareness check
Whether your staff understand their responsibilities, know how to handle requests, and know what to do in a breach.
How the audit runs
A rigorous, documented assessment process that produces reliable and actionable results.
- 1
Assessment
We gather information about your organisation, processing activities and current controls.
- 2
Gap identification
We compare your practices against CDPA requirements and document every gap.
- 3
Structure
We organise findings into a risk-rated gap register with mapped CDPA obligations.
- 4
Alignment
We produce the written report and action plan, and walk your team through the findings.
- 5
Ongoing support
Optionally, we support implementation of the action plan and run follow-up reviews.
Who needs an audit
An audit is the starting point for any serious compliance programme. It matters most for:
- Organisations preparing for POTRAZ registration
- Businesses responding to a regulatory enquiry
- Companies undergoing procurement due diligence
- Boards seeking data governance assurance
- Organisations after a breach or incident
- Businesses entering new processing activities
- Banks and financial institutions
- Healthcare organisations
- HR and payroll companies
- Schools and universities
- NGOs and development partners
- Any organisation holding employee data
Get a clear picture of where you stand
Book a gap assessment and receive a structured, evidence-based report ready for board reporting, regulatory submission or procurement requirements.