Are you operating as an unregistered data controller?
Since the CDPA came into force, many Zimbabwean organisations holding personal data are legally required to register with POTRAZ as data controllers. Most have not — because they are unaware of the requirement, unsure how the process works, or uncertain whether it applies to them. Not registering is not a grey area. It is a breach of the law.
- Legal exposure
- Operating as an unregistered data controller contravenes the CDPA and exposes your organisation to formal enforcement.
- Application complexity
- Registration requires detailed documentation of your data flows, processing purposes and security measures.
- Ongoing obligations
- Registration is not a one-time event. Controllers must maintain accurate records and notify POTRAZ of material changes.
Registration protects you and the people whose data you hold
POTRAZ registration is more than a bureaucratic requirement. It is a formal declaration of your processing activities, a commitment to lawful data handling, and the cornerstone of a broader compliance programme. Registered organisations demonstrate accountability to regulators, clients, staff and partners.
- Registration confirms your processing is lawful and transparent
- Registered status is required by many procurement and audit processes
- It demonstrates accountability to data subjects and regulators
- It enables you to take on clients and partners who require it
- It reduces the risk of investigation, enforcement and reputational harm
How we guide you through it
We do the heavy lifting. From initial readiness assessment to submission and post-registration compliance, we manage the process on your behalf.
Registration readiness review
We assess your current practices against POTRAZ requirements and identify what needs preparing.
Data inventory and mapping
We document every personal data category, processing purpose, legal basis, source and retention period.
ROPA development
We build the record of processing activities the CDPA and the registration process require.
Security documentation
We prepare documentation of your technical and organisational measures for submission.
Application management
We prepare and submit the application, and manage queries and correspondence with the regulator.
Post-registration compliance
We maintain your registration, notify POTRAZ of changes and keep continuing obligations current.
Our registration process
From the first conversation to the data controller certificate, as a structured and managed process.
- 1
Assessment
We review your data landscape and confirm your registration obligations.
- 2
Gap identification
We identify what documentation and processes you still need to create.
- 3
Structure
We prepare your full application pack: ROPA, policies and security documentation.
- 4
Alignment
We submit the application and liaise with POTRAZ through the review.
- 5
Ongoing support
We maintain your registration and keep obligations current as your organisation changes.
Which organisations must register
If your organisation processes personal data about anyone in Zimbabwe, you are very likely a data controller and must register. That includes:
- Commercial banks and MFIs
- Insurance companies
- Hospitals and clinics
- Schools and universities
- HR agencies
- E-commerce businesses
- Telecoms operators
- Government ministries
- Law firms
- Retailers with loyalty cards
- Employers of any size
- Media companies
Start your registration today
We manage the process for you, from data mapping to certificate receipt, so you can focus on running your organisation.