StoneGuard › Get compliant

Get your business licensed with POTRAZ and inspection ready

StoneGuard gets Zimbabwean businesses licensed with POTRAZ as data controllers and ready for inspection under the Cyber and Data Protection Act [Chapter 12:07]. Certified Data Protection Officers run your gap analysis, licence application, registers, policies and staff training. Packages start at $250, after a $90 consultation that is credited in full toward the package.

Last reviewed 2 September 2026.

Does this apply to your business?

Statutory Instrument 155 of 2024 requires every organisation that holds personal data to license with POTRAZ as a data controller. Personal data is anything that identifies a living person: customer names, phone numbers, national ID numbers, addresses, payroll files, patient records, CCTV footage, job applications.

That covers almost every trading business in Zimbabwe, not only technology companies. If you keep a customer list, run a payroll or hold staff files, you are a data controller and the obligation applies to you.

Every legal entity licenses separately. A licence is issued to a legal entity, not to a group or a brand. If you run several registered companies, each one that acts as a data controller applies in its own name.
The licence has to be renewed. The Data Controller licence runs for twelve months and is renewed annually, with the POTRAZ fee paid at cost each time.
Training is mandatory. Staff training is a requirement under CDPG 1 of 2025, not an optional extra.

Inspections have already started

POTRAZ inspections begin on 1 September 2026. Inspections are risk based, and healthcare is in the first wave along with other high volume and sensitive data environments.

An inspection is about evidence. Having applied for a licence is not the same as being able to show a current record of processing activities, a signed privacy policy, a breach procedure that staff know how to follow and training records with names against them.

How StoneGuard gets you there

You are paired with a certified Data Protection Officer who runs the work on the StoneGuard platform. You answer questions about your organisation. The DPO does the rest.

Consultation. A $90 consultation opens the engagement. We work out what personal data you hold, which POTRAZ tier you fall into and what is missing. The fee is credited in full toward your package when you proceed.
Gap analysis. A certified Data Protection Officer assesses your organisation against the Cyber and Data Protection Act on the StoneGuard platform and gives you a scored report with the gaps ranked.
Licensing. We prepare and file your Data Controller licence application and your DPO appointment notification, and we handle the correspondence with POTRAZ until the licence is granted.
Documentation. Your record of processing activities, privacy policy, consent wording, breach response procedure and data subject request procedure are drafted and put in place.
Training. Staff training is delivered, which CDPG 1 of 2025 makes mandatory for licensed data controllers.
Ongoing DPO. A certified Data Protection Officer stays on record for you after the licence is granted, keeps the registers current, handles data subject requests and breaches, files the annual renewal and attends POTRAZ inspections.

What it costs

The StoneGuard service fee and the POTRAZ government fees are two separate numbers. Compliance packages start at $250. A $90 consultation opens the engagement and is credited in full toward your package when you proceed.

POTRAZ fees are paid directly to POTRAZ at cost, ex VAT. There is a $30 application fee, which does not apply at Tier 1, and then a Data Controller licence fee that depends on how many records you hold.

POTRAZ fees shown ex VAT. POTRAZ adds VAT on its own invoice and you pay POTRAZ directly.
POTRAZ tier	Records held	Licence fee (ex VAT)	Application fee
Tier 1	Up to 1,000 records	$50	Not applicable
Tier 2	Up to 100,000 records	$300	$30
Tier 3	Up to 500,000 records	$500	$30
Tier 4	Over 500,000 records	$2,500	$30

Why organisations use StoneGuard

Certified Data Protection Officers. Your compliance is run by a certified DPO who goes on record for your organisation, not by a template pack you are left to fill in yourself.
One fixed package, not line by line. Packages start at $250 and cover the whole licensing job. POTRAZ fees are paid to POTRAZ at cost, ex VAT, and are separate from the StoneGuard service fee. You will always see two numbers, never one blended figure.
Everything on one platform. Your assessment, registers, reports and remediation tasks live in the StoneGuard platform, so you can show an inspector current evidence instead of hunting through email.
Hosted in Zimbabwe. Your compliance data is stored and hosted on infrastructure in Zimbabwe, in line with the Cyber and Data Protection Act.
It does not stop at registration. Registration is the start of the obligation. The licence runs for twelve months and has to be renewed, the registers have to stay current, and an inspector will ask for evidence of both.

Frequently asked questions

Does my small business really need a POTRAZ data controller licence?

Statutory Instrument 155 of 2024 requires every organisation that holds personal data to license with POTRAZ as a data controller. Size is not the test. If you hold customer, staff or patient records, the obligation applies. Size determines your tier and therefore your licence fee, not whether you have to register.

How much does POTRAZ data protection compliance cost in Zimbabwe?

There are two numbers. StoneGuard compliance packages start at $250, after a $90 consultation that is credited in full toward the package. POTRAZ fees are separate and paid at cost, ex VAT: a $30 application fee from Tier 2 upward, plus a licence fee of $50 at Tier 1, $300 at Tier 2, $500 at Tier 3 and $2,500 at Tier 4.

What happens if I am not registered when POTRAZ inspects?

Inspections under the Cyber and Data Protection Act [Chapter 12:07] begin on 1 September 2026 and are risk based, with healthcare in the first wave. If you are not licensed, the fastest route is to start the application now and have the supporting documentation in place, rather than wait to be contacted.

Do I need to appoint a Data Protection Officer?

A licensed data controller appoints a Data Protection Officer and notifies POTRAZ of the appointment. At Tier 1 a DPO is required only where you process sensitive data such as health, children or biometric data. StoneGuard pairs you with a certified DPO who goes on record for your organisation.

How long does it take to get licensed?

It depends on how complete your documentation is when you start. The work that takes time is the gap analysis, the registers and the supporting documents. Collecting your certificate of incorporation, your DPO designate details and your record, site and staff counts at the outset is what keeps a filing moving.

Get licensed and inspection ready

A $90 consultation opens the engagement and is credited in full toward your package when you proceed. Compliance packages start at $250. POTRAZ fees are separate and are paid to POTRAZ at cost, ex VAT.

Contact StoneGuard: email [email protected], WhatsApp +263 77 272 4514, or call +263 77 143 6742. StoneGuard is based in Harare, Zimbabwe.