Zimbabwe’s Postal and Telecommunications Regulatory Authority (POTRAZ) is set to commence active enforcement of data protection laws starting September 2026. This move signals a serious commitment from Zimbabwe to safeguard personal data, particularly as digital services continue to expand across the nation. The enforcement phase follows a registration deadline that expired on March 12, 2025, which many organizations reportedly failed to meet. Under Statutory Instrument 155 of 2024, processing personal data without the required license can lead to substantial fines or even imprisonment for responsible executives. Furthermore, data breaches must be reported to POTRAZ within 24 hours, with affected individuals notified within 72 hours if significant risks are involved.
Key Players Involved
- POTRAZ: Zimbabwean regulatory authority responsible for telecommunications and data protection.
- Zimbabwean Organizations: Entities processing personal data, now subject to stricter compliance and potential penalties.
Event Timeline
- September 2024: Zimbabwe introduces Statutory Instrument 155 of 2024, requiring organizations to obtain data controller licenses.
- March 12, 2025: The initial deadline for organizations to register as data controllers expires.
- July 29, 2026: News emerges detailing POTRAZ’s plan to begin active enforcement of data protection laws in September 2026.
