DPO services
Under SI 155 of 2024 a licensed data controller in Zimbabwe must appoint a Data Protection Officer. Lioncap Ventures acts as your certified officer on record with POTRAZ, handling breach and incident response, data subject requests, POTRAZ correspondence, the annual audit and your licence renewal. Outsourced, dedicated and full time embedded arrangements are available.
Last updated 2026-08-28. Lioncap Ventures, Harare, Zimbabwe.
The Data Protection Officer is the named person accountable for your organisation’s compliance with the Cyber and Data Protection Act. The role is notified to POTRAZ by name on Form DP2, which means it is a real appointment on a public record rather than an internal job title.
In practice the duties are the same whatever the size of the organisation:
Every licensed data controller needs an appointed officer. There is one important qualification for the smallest organisations: a Tier 1 organisation, holding up to 1,000 records, needs an officer where it processes sensitive data. Sensitive data means health information, children’s data and biometric data.
That still captures a great many small organisations. A single site clinic, a creche, a small school, a physiotherapy practice or a laboratory all handle health or children’s data by the nature of the work, and so all need an officer even at the smallest record volume. A small trading company that holds only staff files and a customer list is in a different position, and the consultation settles which side of the line you sit on.
From Tier 2 upwards the appointment applies regardless of what kind of data you hold.
The requirement is that you have an officer. How that officer is provided is a commercial decision, and there are three arrangements plus the option of appointing your own.
The right arrangement is confirmed at the consultation, alongside your licence tier and your assessment.
A question we are asked often is why another organisation pays a different amount for what looks like the same service. The answer is that the duties listed above are identical at every level. What changes with the size of the organisation is the service limits, not the coverage.
A Tier 1 organisation runs on next working day breach response, a six monthly record sweep and management report, an annual light touch audit and one training session a year. A Tier 2 organisation moves to same working day breach response and a quarterly cycle. Tier 3 adds a four working hour breach response, a quarterly board report, an interim audit at six months and unlimited inspection attendance. Tier 4 runs on a two hour, round the clock breach response, monthly reporting and a full audit every six months.
A smaller organisation pays less because it is smaller, not because it is less covered.
We are explicit about the boundary so there are no surprises later. The following is quoted separately rather than absorbed into the ongoing role:
Hiring a data protection officer means recruiting for a specialised, certified skill set that most Zimbabwean organisations need only intermittently. The work arrives in bursts: a breach at an inconvenient hour, a data subject request with a deadline attached, a renewal, an inspection. Between those events the function is quiet, and a full time salary sits against it.
Outsourcing puts a certified officer on record from the day you are licensed, with the response times written down, and it keeps the institutional memory of your compliance file in one place rather than walking out of the door when a staff member resigns. It also separates the officer from the operational decisions they are meant to review, which is the point of having the role at all.
Every engagement begins with a $90 consultation, a one hour working session in which our data protection officers confirm your controller or processor status, map the records you hold, your sites and systems and the partners you share data with, and confirm your exact licence tier. The $90 is credited in full toward your compliance package when you proceed. Packages start at $250.
The agreement follows straight after the consultation, together with your assessment and quotation. It covers both sides: our obligations, your named certified officer on record, deliverables, timelines, confidentiality, breach and incident response and the POTRAZ filings, and on your side access to the information we need, a point of contact and the agreed fees.
Yes. Under SI 155 of 2024 a licensed data controller must appoint a Data Protection Officer, who is notified to POTRAZ by name on Form DP2. For a Tier 1 organisation holding up to 1,000 records, the appointment is required where sensitive data such as health, children’s or biometric data is processed.
Yes. Lioncap Ventures provides your required officer on record with POTRAZ. You can take an outsourced officer from our certified pool, a dedicated named officer for a regulated sector, or a full time embedded officer. If you already have your own appointed officer, no retainer applies and we prepare and file everything else.
You can. The officer must be identified to POTRAZ on Form DP2 with their identity document and their educational and professional certificates or a data protection officer certificate. Many organisations appoint internally and then use us for the filings, the documents and the annual audit while their own officer signs off.
Your officer is on call. We assess whether the incident is reportable, contain it with your team, prepare and lodge the notification to POTRAZ and to affected individuals where that is required, and document the whole response so it stands up at inspection. Response times are set by your service level, from next working day at the smallest tier to two hours round the clock at the largest.
The officer retainer is set by your organisation size, and for a dedicated officer by your industry group as well. We confirm the figure at your $90 consultation, once your record tier and sites are established, and it forms part of the written quotation. We do not quote a retainer before we know your tier, because that produces a number neither of us can rely on.
A $90 consultation begins any engagement and is credited toward your package if you proceed. Existing Lioncap Ventures clients save 10% on the service fee.
Contact Lioncap Ventures: email [email protected] or WhatsApp +263772724514.