Are you processing personal data without a compliance framework?
Every time your organisation collects a name, email address, ID number, health record or financial detail, you are processing personal data — and under the Cyber and Data Protection Act that carries legal obligations. Yet most organisations have no structured privacy programme, no data mapping, and no documented process for handling data subject requests, breaches or third-party sharing.
- Regulatory exposure
- Operating without POTRAZ registration or adequate controls exposes your organisation to regulatory action.
- Reputational damage
- A breach or privacy complaint can destroy the trust of customers, partners and regulators overnight.
- Contractual risk
- Procurement teams, international partners and auditors increasingly require documented data protection practices.
The CDPA is not optional, and POTRAZ is watching
Zimbabwe's Cyber and Data Protection Act establishes a binding framework for how organisations collect, use and protect personal data. POTRAZ, as the data protection authority, can investigate, impose fines and publicly sanction non-compliant organisations. Compliance is not about paperwork — it is about operating lawfully and protecting the people in your database.
- The CDPA requires a lawful basis for all personal data processing
- Data controllers must register with POTRAZ
- Individuals have the right to access, correct and delete their data
- Data breaches must be reported to POTRAZ within 72 hours
- Third-party data sharing requires appropriate contractual safeguards
What we deliver
Practical, documented outputs rather than theoretical advice. Everything we produce is ready for regulatory review, board reporting and operational use.
Compliance assessment
A structured review of your current practices against CDPA requirements, producing a gap register and risk score.
POTRAZ registration support
Guidance through the data controller registration process, from application to approval.
Privacy policies and ROPA
Your privacy notice, internal data protection policy and record of processing activities, drafted for your organisation.
Data mapping
Identifying what personal data you hold, where it flows, who has access and what risk it carries.
Staff awareness training
Practical sessions on CDPA obligations, day-to-day data handling and breach response.
Ongoing advisory
Continued support as you grow, take on new processing activities or face regulatory enquiries.
Our compliance process
A structured five-stage approach that takes you from assessment to lasting compliance control.
- 1
Assessment
We review your data flows, systems, policies and current compliance posture.
- 2
Gap identification
We document every gap between your current practices and CDPA requirements.
- 3
Structure
We build the policies, documentation and processes your compliance programme needs.
- 4
Alignment
We register, train and embed controls so compliance is operational rather than theoretical.
- 5
Support
We stay alongside you for reviews, incidents and regulatory updates.
Who needs a data protection consultant
Any organisation processing personal data in Zimbabwe benefits from professional compliance guidance. Our clients include:
- Banks and financial services
- Healthcare providers
- Schools and universities
- HR and recruitment agencies
- Insurance companies
- NGOs and charities
- Retail and e-commerce
- Telecoms and ISPs
- Government departments
- Law firms
- SMEs and startups
- Logistics and transport
Start with a conversation
Not sure where your organisation stands on CDPA compliance? Book a free 30-minute discovery call and we will give you an honest assessment of your risk exposure.