Licensing
Every organisation in Zimbabwe that holds personal data must register with POTRAZ as a licensed Data Controller under Statutory Instrument 155 of 2024. You apply on Form DP1, notify your Data Protection Officer on Form DP2, declare how many records you hold, and pay the POTRAZ licence fee for your tier. Lioncap Ventures prepares and files the application for you.
Last updated 2026-08-28. Lioncap Ventures, Harare, Zimbabwe.
If your organisation decides why and how personal data is used, you are a data controller and you need a POTRAZ Data Controller licence. Personal data is any information that identifies a living person, so this covers your staff files, your customer database, your patient or learner records, your membership register, your supplier contacts and your CCTV footage. Almost every trading organisation in Zimbabwe holds personal data of some kind, which is why the licence is not limited to technology companies.
If instead you handle personal data on behalf of another organisation, and that organisation decides what happens to it, you are a data processor. A processor still registers with POTRAZ, and additionally needs data processing agreements with each controller it serves, security controls and a documented breach procedure. Many organisations are both at once: a controller for their own staff and customer data, and a processor for work they perform for clients.
Being unsure is common and it is not a problem. The classification is settled at the consultation before anything is filed, because filing under the wrong status means filing twice.
The Cyber and Data Protection Act (Chapter 12:07) is Zimbabwe’s data protection law, and Statutory Instrument 155 of 2024 is the regulation that turned registration from good practice into a legal requirement. Under SI 155 a data controller must hold a licence issued by POTRAZ, and must appoint a Data Protection Officer who is notified to the regulator by name. Operating as an unlicensed controller is an offence under the Act.
The licence is not a one off certificate that you file away. It renews annually at your tier fee, your record of processing has to stay current, and any material change in what you do with personal data is notified to POTRAZ. From 1 September 2026 inspectors can ask to see all of it.
POTRAZ licensing runs on two forms, both of which are obtained from the regulator. Form DP1 is the Data Controller licence application, and the same form is used again at renewal. Form DP2 is the Data Protection Officer notification, which tells POTRAZ who is accountable for compliance inside your organisation.
Each form carries required attachments, and an application that is missing one of them is the most common reason a filing stalls.
The complete set is submitted as one bundle. A submission that is disapproved has to be resubmitted as a complete new set, clearly marked as a resubmission, which is the other reason it pays to get the attachments right the first time.
Your tier is set by the total number of individuals whose personal data you hold, counting staff, customers, patients, learners, members and partners together. It is a count of people, not of files or documents, so one customer with ten years of transaction history is still one record.
Most small businesses, clinics, schools and church congregations sit in Tier 1 or Tier 2. The consultation confirms your tier before anything is filed, so you never pay for a bigger licence than your organisation needs.
There are two separate costs and we always quote them separately. The first is the POTRAZ fee, which is a government charge and is passed through to you at cost with no markup. The second is the Lioncap Ventures service fee for preparing, documenting and filing everything.
The $30 application fee applies from Tier 2 upwards. A Tier 1 organisation does not pay it, and it is not charged again on an annual renewal.
The licence fee itself becomes payable once your application is approved, and it renews annually at the same tier fee.
Every POTRAZ figure above is exclusive of VAT, which POTRAZ adds on its own invoice at a rate we do not set. That is why we quote our service fee and the POTRAZ fees as two separate numbers and never give you a single all-in total. You pay POTRAZ exactly what POTRAZ bills us, with no markup.
Every engagement begins with a $90 consultation, a one hour working session in which our data protection officers confirm your controller or processor status, map the records you hold, your sites and systems and the partners you share data with, and confirm your exact licence tier. The $90 is credited in full toward your compliance package when you proceed. Packages start at $250.
This is the sequence we run for every client, from the first conversation to a filed application.
A $90 working session that confirms your controller or processor status, maps your data footprint and fixes your licence tier. You receive a written assessment and an accurate quotation.
The agreement is signed straight after the consultation, and we request the full document set at that point rather than in pieces. Nothing beyond the consultation fee is owed until you have read it and chosen a package.
We compare what you have against what the Act requires, then build your data inventory and record of processing activities across every department, system and site.
Privacy policy and consent wording, breach response procedure, data subject access request procedure, the physical records security checklist and, where health or children’s data is involved, a data protection impact assessment.
Your officer is named and notified to POTRAZ on Form DP2, whether that is someone inside your organisation or a Lioncap officer on record for you.
Staff who handle personal data are trained as required under CDPG 1 of 2025, and the attendance record is kept as evidence for inspection. We run sessions off hours so your working day is not disrupted.
The DP1, the DP2 and every attachment go to POTRAZ as one complete bundle, followed by your processing notification.
Most small organisations are documented and filed within one to two weeks of the consultation, and the pace is usually set by how quickly the company documents and the officer’s certificates come back to us rather than by the drafting itself.
Larger enterprises, groups and government ministries, departments and agencies take longer because of the audit work and the multi site rollout, but the timeline is built backwards from the inspection date so that you are ready before an inspector arrives rather than after.
Licensing is the start of the obligation, not the end of it. Your record of processing has to be swept and updated, changes in how you use personal data have to be notified to POTRAZ, staff training has to be refreshed, policies have to be reviewed and re approved, and the licence has to be renewed each year. Data subject requests and any breach have to be handled inside the timelines the Act sets.
That ongoing work is what the Data Protection Officer role covers. If you appoint your own officer, you run it internally. If you do not have one, Lioncap Ventures acts as your officer on record and runs the compliance year for you.
Yes. Staff records are personal data, so an organisation that holds nothing but employee files is still a data controller and still needs to register. Record volume affects which tier you fall into and therefore what you pay, not whether the licence applies to you.
Form DP1 is the POTRAZ Data Controller licence application, and the same form is used for the annual renewal. It is submitted with the entity’s certificate of incorporation or equivalent registration document, and from Tier 2 upwards with proof of payment of the application fee. Lioncap Ventures completes and files it for you.
The licence fee depends on how many records you hold: $50 at Tier 1, $300 at Tier 2, $500 at Tier 3 and $2,500 at Tier 4. From Tier 2 upwards there is also a $30 application fee. These are POTRAZ figures, exclusive of VAT, and we pass them through at cost. Our service fee is quoted separately and starts at $250.
It renews annually at your tier fee. The renewal uses the same DP1 form and the application fee is not charged again. We file the renewal for you under the Data Protection Officer retainer.
Operating as an unlicensed data controller is an offence under the Cyber and Data Protection Act. From 1 September 2026 POTRAZ inspectors can check your licence, and being unlicensed or undocumented exposes you to enforcement action and penalties. If you have already missed a step we can fast track the essentials first.
A $90 consultation begins any engagement and is credited toward your package if you proceed. Existing Lioncap Ventures clients save 10% on the service fee.
Contact Lioncap Ventures: email [email protected] or WhatsApp +263772724514.