How it works

Your Data Controller Licence,
start to finish

Zimbabwe's Cyber and Data Protection Act requires organisations that handle personal information to register with POTRAZ. This is how we take you through it — ten steps, seven of them yours, four of them ours.

Nothing is payable until you have seen your quotation.

The short version

  1. 1You answer a few questions about how your organisation handles personal data.
  2. 2We work out which POTRAZ tier you fall into.
  3. 3We quote you against that tier — so you see the price before you commit.
  4. 4You pay, complete your forms, and we lodge everything with POTRAZ.
  5. 5While POTRAZ reviews, you work through a compliance checklist with us.
  6. 6Your licence is issued.

The ten steps

You can see exactly where you are at any point.

01

Compliance check

We do this

You answer eight short questions on our website about how your organisation handles personal data. It takes about three minutes and costs nothing.

  • You get a reference straight away — something like DHA-2026-0001. Keep it: you can quote it to us and use it to check your progress.
02

Apply for assessment

You do this

You create an account and tell us the basics — your organisation, sector and who we should speak to. Everything you have already told us is carried over, so you are not typing it twice.

03

Tier assessment

We do this

Our consultants determine your POTRAZ registration tier and issue a Tier Assessment Report explaining which tier you are in and why.

  • This comes before any pricing, deliberately. The tier sets both the statutory POTRAZ fee and the work involved, so we cannot quote you honestly until we know it.
04

Quotation

We do this

Your quotation, priced against your assessed tier. It sets out our advisory fee and the POTRAZ fees payable.

05

Pay fees

You do this

You settle the invoices and upload proof of payment — a bank transfer confirmation, an EcoCash receipt, whatever you have. We check it and confirm.

06

Statutory forms and documents

You do this

The POTRAZ DP1 and DP2 forms, which we have already filled in from what you have given us. You add your company registration, Data Protection Officer and what your organisation does, check the rest, and sign them off.

  • You also upload your Certificate of Incorporation and director details. We only ask for these once you have gone ahead — nobody hands over company details just to get a quote.
07

Record of Processing Activities

You do this

A record of what personal data you process and why. Our guided form takes one activity at a time — the purpose, the lawful basis, who the data is about, how long you keep it and how you protect it.

  • A legal requirement in its own right, and it fills in most of your DP2 form for you.
08

Submission to POTRAZ

We do this

We lodge your completed file with POTRAZ and send you the reference, along with the date we expect a decision by.

09

Gap analysis

You do this

Fifty compliance controls across eight areas. For each one you record where you stand, add a note and attach evidence. Anything not relevant to you can be marked as such.

  • This runs while POTRAZ reviews your file, so the wait is not wasted. Work you have already done is carried across, and our consultants work through it with you.
10

Licence approval

We do this

POTRAZ issues your Data Controller Licence. Your licence number and expiry date appear in your portal, and we contact you before renewal.

Which tier are you?

Your tier depends mainly on how many individuals' records you hold. Organisations handling sensitive information — health records, for example — may sit a tier higher than volume alone would suggest.

TierRecords held
Tier 150 – 1,000
Tier 210,001 – 100,000
Tier 3100,001 – 500,000
Tier 4More than 500,000

What to gather

Worth having to hand before you start.

  • Certificate of Incorporation
  • Company registration number and registered address
  • Details of your Data Protection Officer
  • Director details
  • A rough figure for how many individuals' records you hold
  • Any privacy policy, staff training records or data protection documents you already have

If we need something specific to your circumstances, it appears in your portal under Requested documents and we email you about it.

Keeping track

Three ways to see where things stand.

  • Sign in to your portal
  • Click the tracking link in any email from us
  • Use Track Progress with your reference and email

Your references

DHA-…
your compliance check
DH-…
your licence application

We email you every time something moves — your tier, your quotation, your payment, the POTRAZ lodgement and your licence.

Common questions

How long does the whole thing take?
Most of it depends on how quickly information comes back to us. Once we lodge with POTRAZ, expect 14 working days to a month for the licence itself.
When do I have to pay?
After you have seen your quotation at step 5. Nothing before that.
Why do I give you my company details before I know the price?
Because the price depends on your tier, and we cannot work out your tier without them. We would rather quote you accurately than guess.
Do I have to finish the gap analysis before my licence is issued?
No. It runs alongside the POTRAZ review and does not hold up your licence.
What if I lose my reference?
Reply to any email from us, or get in touch — we will find it.

Start with the compliance check

Eight questions, about three minutes, no cost. It is the first step, and it tells us enough to assess your tier.

Start your assessment

Or book a consultation to talk it through first.