A privacy policy copied from the internet is not compliance
Many Zimbabwean organisations have a privacy policy on their website — usually a generic template that does not reflect their actual processing, does not meet CDPA specifics, and would not survive scrutiny from POTRAZ, an auditor or an international procurement team. Fewer still have a ROPA, a retention policy, or documented procedures for data subject rights. Those omissions are real legal exposure.
- No ROPA
- Operating without a Record of Processing Activities is a direct breach of CDPA accountability requirements.
- Non-compliant privacy notices
- A notice that does not reflect your actual processing, or omits required information, provides no legal protection.
- Missing procedures
- Without documented procedures your staff cannot handle data subject requests, breaches or third-party sharing consistently.
Documentation is the evidence of compliance, not its substitute
The CDPA's accountability principle requires data controllers to demonstrate compliance, and documents are the evidence. A complete, accurate and regularly reviewed pack is the foundation every other compliance activity rests on — POTRAZ registration, third-party procurement, breach response.
- A ROPA is required by the CDPA and is central to POTRAZ registration
- Privacy notices must be provided to data subjects under the CDPA
- Retention policies reduce the risk of keeping data longer than necessary
- Processing agreements protect you when sharing data with third parties
- Documented procedures ensure consistent, lawful handling of data subject rights
What we develop for you
Every document is written specifically for your organisation rather than adapted from a template, and reviewed against current CDPA requirements.
ROPA development
A comprehensive record of your processing activities, built through data mapping interviews and document review, formatted for POTRAZ submission.
Privacy notice
A CDPA-compliant notice for your website, customer communications and service delivery, written in clear and accessible language.
Data protection policy
An internal policy setting out your organisation's obligations, responsibilities and operating standards for staff.
Data retention framework
A retention schedule defining how long each category of personal data is held, and the process for secure deletion or anonymisation.
Data processing agreements
Agreements with your third-party processors that meet CDPA requirements and protect you from downstream handling failures.
Data subject rights procedures
Step-by-step procedures for receiving, validating and responding to access, erasure and other rights requests.
How we develop it
A structured process that produces accurate, organisation-specific documentation ready for regulatory and operational use.
- 1
Assessment
We review your processing activities, existing documents and systems.
- 2
Gap identification
We identify which documents are missing, incomplete or non-compliant.
- 3
Structure
We develop each document from your actual operations rather than generic templates.
- 4
Alignment
We review drafts with you, incorporate feedback and finalise the pack.
- 5
Ongoing support
We maintain and update your documentation as your organisation and the law evolve.
Who needs a documentation pack
Any organisation subject to the CDPA needs compliant documentation. It is most urgent for:
- Organisations registering with POTRAZ
- Companies responding to procurement requests
- Businesses preparing for ISO 27001
- Organisations after a data incident
- Banks and financial institutions
- Healthcare providers
- Schools and universities
- HR and payroll companies
- NGOs receiving international funding
- Tech companies holding user data
- Law firms and professional services
- Any business with a website
Build your documentation pack
Organisation-specific, CDPA-compliant documentation ready for POTRAZ review, procurement due diligence and day-to-day operational use. We write it for you.