The CDPA grace period has expired. POTRAZ is auditing now. Complai Africa helps your organisation get properly documented, prepare for registration, and match with the right POTRAZ-certified DPO — while the legal filing and appointment remain your organisation's responsibility.
Most organisations in Zimbabwe are legally exposed. Complai Africa bridges the gap between the law and under-resourced organisations.
Every organisation processing data of 50+ individuals must register with POTRAZ and pay the annual licensing fee (Tier 1: $50 to Tier 4: $2,500). Complai Africa supports preparation with templates, checklists, and guidance, but the filing remains the organisation's responsibility.
Every data controller must appoint a DPO and notify POTRAZ via Form DP2. Failure carries a Level 7 fine and up to 2 years imprisonment. Complai Africa helps you identify and match with a suitable POTRAZ-certified DPO, but the appointment remains the organisation's responsibility.
Using Google Workspace, Microsoft 365, or any offshore cloud constitutes a cross-border transfer requiring separate POTRAZ authorisation.
Data breaches must be notified to POTRAZ within 72 hours of discovery. Failure: Level 9 fine (~$2,000) and up to 3 years imprisonment.
Sector-specific frameworks built around the exact requirements of the CDPA, S.I. 155 of 2024, and POTRAZ Implementation Guidelines.
Schools are the highest-risk category. You process sensitive data of children (under 18) — placing you under the strictest provisions of CDPA Section 12 and CDPG 2 of 2024. Schools are not eligible for Tier 1 DPO exemption.
Health data is explicitly classified as sensitive data under CDPA Section 12. Only a health professional may process health-related data, and written consent is required for biometric, genetic and health data processing.
MFIs process National IDs, financial history and credit data — all classified as sensitive data under the CDPA. FinGuard addresses both POTRAZ data protection and RBZ KYC requirements.
Property managers collect ID copies, payslips, and bank statements from every tenant and buyer. PropSafe legally secures your data handling and ensures cross-border compliance for international landlords.
If you collect customer names, emails or payment data and have 50 or more data subjects, you are a Data Controller under the CDPA. BizSecure covers Tier 1 licensing (50–1,000 data subjects).
Hotels and lodges collect extensive guest data — passport copies, credit card details, booking history and CCTV footage. HotelGuard ensures full CDPA compliance and protects your guest privacy obligations under Zimbabwe's tourism regulations.
Submit your details. We match your sector, confirm your POTRAZ tier, and create your account within 24 hours.
A POTRAZ-certified DPO is matched to your organisation. They review your data footprint and initiate POTRAZ filings.
Forms DP1 and DP2 filed with POTRAZ. Cross-border authorisation applied for if required. All within 5 business days.
Use the prepared templates, supporting pack, and DPO match to complete your organisation's registration and appointment process directly with POTRAZ.
Every Complai Africa toolkit includes structured compliance frameworks and document templates — designed specifically for Zimbabwe's regulatory environment and ready for POTRAZ inspection.
Use these tools to understand your compliance gap, quantify your risk exposure, and generate a baseline privacy notice before you choose a paid package.
These tools generate starting-point outputs. For board-ready documentation, sector packs, and managed DPO support, move into a Comply package.
All prices in USD. Comply is now sold as a toolkit line, with sector packs and DPO Shield layered on where needed. POTRAZ government fees remain separate and are paid directly to POTRAZ.
Each sector path combines the right Comply tier, the right sector pack, and the right DPO Shield level for that operating model.
Children's data obligations, parental consent, DPIAs, and cross-border authorisation for cloud services make education one of the most closely regulated sectors.
Explore SafeSchool →Health, biometric and genetic data require written consent under CDPA Section 12. Only health professionals may process health data.
Explore MedShield →Financial history and ID data are sensitive under CDPA. FinGuard satisfies both POTRAZ and RBZ compliance obligations.
Explore FinGuard →Every tenancy application collects sensitive data. PropSafe ensures legally compliant data handling and cross-border compliance.
Explore PropSafe →50+ customers or employees makes you a Data Controller. BizSecure gives you Tier 1 POTRAZ compliance.
Explore BizSecure →Hotels collect passport copies, credit cards and CCTV footage. HotelGuard covers guest privacy and international booking platforms.
Explore HotelGuard →Are you a POTRAZ-certified Data Protection Officer? We provide the clients and infrastructure — you provide the professional certification and oversight.
We handle all sales and marketing. You focus on delivering compliance services to organisations we place with you.
Our automated toolkit handles 80% of groundwork. You review, advise, sign Form DP2, and liaise with POTRAZ.
You carry the professional oversight responsibility and receive the larger share. 30/70 on one-off toolkit sales.
Clear response time obligations: 4 hours for critical breaches, 24 hours for POTRAZ requests, 48 hours for standard queries.
POTRAZ-approved certification required. HIT-certified DPOs preferred.
Lawyers with POTRAZ-certified DPO status can provide both legal advice and official oversight.
IT security professionals with POTRAZ certification can extend compliance services through our platform.
60% of retainer to POTRAZ-certified DPO. 40% to Complai Africa platform.
Not sure where to start? Submit your details and we'll tell you which Comply tier, sector pack, and DPO Shield path best fit your organisation, then help you prepare the right templates and DPO-matching route.
Forms DP1, DP2 and DP3 available at www.potraz.zw
info@potraz.gov.zw | dpa@potraz.gov.zw
+263 242 333032/46/48
We respond within 24 hours. Your data is processed under our own CDPA-compliant privacy policy.
Choose your Comply toolkit first, then add the sector pack and DPO Shield cover that match your organisation's real-world obligations. Your organisation remains responsible for the formal POTRAZ filing and DPO appointment.