Complete Form DP1. Fill out the Application or Renewal Form.
Data Controller Licence · POTRAZ · SI 155 of 2024
A practical guide to the Data Controller Licence: who must apply to POTRAZ, what Form DP1 asks for, which documents to attach, and how long the process takes.
Organisations that decide how personal data is collected and used in Zimbabwe must apply to POTRAZ, the Postal and Telecommunications Regulatory Authority of Zimbabwe, under the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024.
The Act treats automated processing as a regulated activity. A controller must notify the Authority before starting any wholly or partly automated processing operation (Section 20), and the Authority keeps a Register of Data Processing (Section 23). Processing that poses specific risks to individuals’ fundamental rights needs the Authority’s explicit approval before it starts (Section 22).
Complete Form DP1. Fill out the Application or Renewal Form.
Pay the application fee. Remit the applicable POTRAZ fee.
Submit the pack. File the complete application with POTRAZ.
Authority review. POTRAZ evaluates the file and responds within 14 days.
Decision. The Authority communicates its official decision.
Form DP1 is organised in sections. Having each one prepared before you start avoids delays in assembling the pack.
Section 1, applicant details. Operational information, entity type (public, private, NGO) and details of the designated Data Protection Officer.
Section 2, personal data. Data subjects, types of data collected, purpose of processing, recipients and the legal grounds for processing.
Section 3, sensitive personal data. Disclosure of sensitive categories such as medical records, biometric data and race, plus the grounds for processing.
Section 4, data processors. Third-party processors and confirmation that written contracts are in place.
Sections 5 and 6, cross-border transfer and security. International transfers or storage need separate authorisation, together with documented safeguards such as access controls and encryption.
Section 7, checklist and sign-off. A signed declaration and an accompanying Certificate of Incorporation.
Completed Form DP1 with every section answered and signed.
The application fee paid to POTRAZ.
A Certificate of Incorporation attached to the submission.
A written record of safeguards covering risks, active access controls and the encryption measures in force.
A designated Data Protection Officer certified and named on the form.
A licence or notification is valid for 12 months. Applications for renewal must be submitted at least three months before expiry. Missing that window risks suspending your lawful processing rights, so diarise the renewal date as soon as the licence is issued.
A valid notification under Section 21 must include the legal basis for processing, the categories of data subjects, the sensitive nature of any data involved, retention periods and planned transborder data flows. For cross-border transfers, the Authority assesses adequacy based on the recipient’s reputation, the laws of the recipient country and the professional security standards it observes (Section 28(2)).
A certified Data Protection Officer must be designated on Form DP1, and the appointment is formally communicated to the Authority using Form DP2. If you do not want to hire one in-house, our DPO-as-a-Service fills that role. For the full picture of the role, read our guide to the DPO in Zimbabwe.
We complete Form DP1, assemble the pack, name a certified DPO and keep the filing aligned with the Act and the regulations. If you are not sure where you stand today, start with a CDPA assessment. The official forms are available on our documents page.
Organisations that decide how personal data is collected and used in Zimbabwe must apply to POTRAZ under the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024.
After you file the pack, the Authority evaluates the application and communicates a decision within 14 days.
Yes. A certified Data Protection Officer must be designated on the form. PrivacyCure can fill that role through DPO-as-a-Service.
Completed Form DP1, the application fee, a Certificate of Incorporation, and a written record of risks, access controls and encryption measures.
A licence or notification is valid for 12 months. Renewal applications must be submitted at least three months before expiry.
Yes. International transfers or storage need separate authorisation, and the Authority assesses the adequacy of the recipient country and the third party’s security standards.
Data Protection Officer (DPO) in Zimbabwe What a DPO does, when you need one, Form DP2 and why independence matters. Read the guide.
Data Breach Notification in Zimbabwe The 24-hour rule, Form DP3, and what to prepare before a breach happens. Read the guide.
Data Subject Rights Under the CDPA The five core rights, consent rules, children’s data and direct marketing. Read the guide.
CDPA Offences and Penalties in Zimbabwe Fines, imprisonment and personal liability under the Act and the Criminal Law Code. Read the guide.
PrivacyCure completes Form DP1, assembles the application pack, names a certified Data Protection Officer and keeps your filing aligned with the Act and its regulations. Email dpo@privacycure.com or use the contact page.
Information only, not legal advice. Statutory references follow the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024. Confirm current requirements with POTRAZ or a qualified adviser before you file or act.