Most data breaches are caused by people, not technology
Phishing emails, weak passwords, accidental data sharing, improper disposal of documents, an unrecognised social engineering attempt — most incidents stem from human behaviour rather than sophisticated hacking. If your staff do not understand the CDPA, cannot recognise phishing, and do not know what to do when something goes wrong, no technical control will fully protect you.
- Ignorance is not a defence
- Your staff's lack of awareness does not exempt the organisation from liability when data is mishandled.
- Breaches from within
- Accidental exposure by employees is among the most common causes of notifiable breaches, in organisations of every size.
- Training is a legal expectation
- POTRAZ expects data controllers to ensure staff understand their obligations and handle personal data responsibly.
Trained staff are a compliance control, not an extra
The CDPA requires data controllers to put appropriate technical and organisational measures in place. Training is a fundamental organisational measure. When POTRAZ investigates an incident, the first questions are about policies, training and staff awareness — a documented programme is essential evidence of a compliance-conscious organisation.
- The CDPA requires adequate organisational measures, training among them
- Trained staff reduce the likelihood of accidental data breaches
- Training records demonstrate compliance culture to POTRAZ
- Cybersecurity training reduces phishing and ransomware risk
- Annual refreshers keep staff current with evolving threats and regulation
What the training service includes
Practical, documented and Zimbabwe-specific training that equips your team to handle personal data lawfully and securely.
General staff awareness
Foundation-level CDPA training for all employees: what personal data is, how to handle it, and what to do when something goes wrong.
Management and data owners
Deeper training on lawful bases, data mapping, ROPA management and decision-making under the CDPA.
HR and payroll data protection
Specialist training on handling employee personal data, managing sensitive data and maintaining lawful records.
Cybersecurity awareness
Recognising phishing, managing passwords, safe remote working, device security and responding to suspicious activity.
DPO and compliance officer training
Advanced work on CDPA obligations, POTRAZ interactions, DPIA methodology, breach management and audit preparation.
Training records and certification
Documented attendance and completion certificates for every session, giving you the evidence trail compliance demonstration requires.
How delivery works
A structured approach that keeps training relevant, effective and documented.
- 1
Assessment
We review your organisation, your processing activities and current staff awareness levels.
- 2
Gap identification
We identify which staff groups need training and which topics are most critical.
- 3
Structure
We develop a tailored programme with relevant, Zimbabwe-specific content.
- 4
Alignment
We deliver the sessions and provide attendance records and completion certificates.
- 5
Ongoing support
Annual refreshers, new-starter induction, and sessions triggered by incidents or regulatory change.
Which organisations need training
Any organisation processing personal data should invest in regular staff training. Our programmes are particularly relevant for:
- Banks and financial institutions
- Healthcare providers
- Insurance companies
- Schools and universities
- HR and recruitment firms
- Government departments
- NGOs and development organisations
- Law and audit firms
- Retailers and e-commerce
- Telecoms and technology companies
- Any employer holding staff data
- Companies onboarding new DPOs
Book training for your team
We design training around your organisation's specific processing activities, sector and staff profile. Every session is practical, relevant and documented.