Data protection for ISPs and community networks in Zimbabwe

Your telecoms licence is not a data controller licence

This is the single most common misunderstanding among operators, and it is an entirely understandable one, because the same organisation issues both.

the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is established under the Postal and Telecommunications Act [Chapter 12:05]. That is the statute your network, service or access licence comes from, and it is the relationship most operators think of when they think of POTRAZ.

Section 5 of the Cyber and Data Protection Act [Chapter 12:07] then does something separate. It designates that same Authority as the Data Protection Authority. Section 6 sets out the functions attaching to that second role, which include regulating how personal information may be processed, enforcing fair processing, conducting inquiries and investigations, and receiving and investigating complaints about data processing.

So POTRAZ wears two statutory hats. As telecoms regulator it licenses you to operate a network and carry traffic. As Data Protection Authority it licenses you, separately, to process the personal data of the people using that network. The second licence is the one operators do not know they need.

• Different statute. The telecoms licence sits under the Postal and Telecommunications Act [Chapter 12:05]. The data controller licence sits under the Cyber and Data Protection Act and SI 155 of 2024.
• Different application. The data controller licence is applied for on Form DP1, under section 4(2) of SI 155, with the fee in the Second Schedule. It is not bundled into a telecoms licence renewal.
• Different obligations. The data controller licence brings a Data Protection Officer notified on Form DP2, a record of processing activities, written agreements with processors, and a twenty four hour breach notification duty.
• No telecoms carve-out. Section 8 of SI 155 exempts only personal, family or household affairs, law enforcement, and journalistic, historical or archival purposes. Being a licensed telecommunications operator is not on that list.

If you have been told, or have assumed, that your existing POTRAZ licence covers your obligations to subscribers, it does not, and section 3(3) of SI 155 makes processing without a data controller licence an offence carrying a fine of up to level 11 or imprisonment of up to seven years or both.

What an ISP actually processes

Operators tend to picture personal data as the billing database. The reality is broader, because a network generates personal data continuously as a by-product of carrying traffic, and much of it is more revealing than the billing record.

• Subscriber records. Names, physical and installation addresses, phone numbers, email addresses, and the identity documents collected at sign up.
• Identity and verification data. National identity numbers, passport numbers and copies of documents taken for subscriber registration or account opening.
• Billing and payment data. Account balances, payment history, mobile money numbers, bank details and arrears records.
• Session and connection logs. RADIUS records, session start and stop times, allocated IP addresses, MAC addresses and data volumes. Where these tie to an identifiable subscriber, they are personal data about that person.
• Location and installation data. GPS coordinates of a home installation, the tower or access point a subscriber attaches to, and site survey photographs.
• Hotspot and captive portal sign-ups. Public wifi registrations, often collecting a phone number or an email in exchange for access, frequently with no notice and no retention rule.
• Support and ticketing records. Call recordings, WhatsApp support threads, ticket histories and the notes engineers write about customers.
• Community network member registers. For a co-operative or community ISP, the membership roll, contributions and household details.
• Staff and premises. Payroll, contractor records, CCTV at sites and offices, and biometric access control at equipment rooms.

Two of those deserve particular attention. Biometric access control brings section 10(2)(d) of SI 155 into play, which requires you to notify the Authority of processing involving biometric and genetic data. And captive portal sign-ups are collected at the moment a person most wants connectivity and least wants to read a notice, which makes the lawfulness of that collection worth examining rather than assuming.

Session and traffic data is personal data

An operator will sometimes argue that logs are technical records rather than personal data. That argument does not hold where the record can be tied back to an identifiable person, and on a subscriber network it almost always can, because the whole point of the authentication system is to know whose session it is.

What makes this category sensitive in substance, whatever its formal classification, is what it reveals. A session log shows when somebody is at home, when they are awake, when they went away and for how long. Tied to the sites contacted, it can reveal a great deal more. That is the reason access to it should be narrow and logged, and the reason a casual internal request for "the logs for this customer" should meet a process rather than a helpful colleague.

• Decide who can query subscriber data. Named roles rather than everyone with a support login, with the access itself recorded.
• Set a retention period and apply it. Logs kept indefinitely because storage is cheap raise both your tier and your exposure. Where a licence condition or another law requires you to retain particular records for a period, that requirement sits alongside your data protection duties rather than replacing them, and the interaction is worth getting advice on rather than guessing.
• Treat lawful requests as a process. Requests for subscriber data should follow a documented route with a record of what was disclosed, to whom and on what basis.
• Log the access, not just the data. Section 24 of the Act requires you to be able to demonstrate compliance. An access log is how you demonstrate that subscriber records were not browsed casually.

Community ISPs and co-operative networks

A community network, a village wifi co-operative or a small WISP serving a suburb usually assumes it is too small and too informal for any of this. That assumption is worth testing against two facts.

The first is that the tier categories in section 6 of Statutory Instrument 155 of 2024 formally begin at 50 data subjects. A community network with a couple of hundred connected households is well past that once account holders, the people named on those accounts, volunteers and committee members are counted.

The second is that the duty to apply in sections 3 and 4 attaches to whoever determines the purposes and means of the processing, and section 3(2)(d) expressly reaches a person processing to obtain a commercial gain "or other benefit". A non profit or cost recovery model does not put a network outside it.

• The entity matters. POTRAZ licenses a legal entity. A community network operating through a trust, co-operative or company licenses in that entity’s exact registered name, and a network with no legal entity at all has a prior problem to solve.
• Volunteers are still staff for training purposes. Training is mandatory for licensed controllers under CDPG 1 of 2025, and a volunteer with access to the subscriber database needs it as much as an employee does.
• Committee members hold data too. Member lists on a treasurer’s personal laptop, or an installer’s phone, are the most common weak point in a community network.
• The smallest tier is genuinely small money. Tier 1 is $50 ex VAT with no application fee. The cost of licensing a small network is not the obstacle people expect it to be.

Where subscriber data leaves the country

Operators are more exposed to cross-border obligations than most businesses, because the supporting systems are so often hosted elsewhere. Section 10(2)(c) of Statutory Instrument 155 of 2024 requires a controller to notify the Authority of any intention to transfer or share data subject information outside Zimbabwe. The notifiable event is the intention, so it belongs before the platform goes live.

Section 28 of the Cyber and Data Protection Act [Chapter 12:07] governs the transfer itself, and section 29 addresses transfers to a country that does not assure an adequate level of protection. Contravening section 28 is one of the five sections named in section 33(2), carrying a fine of up to level 11 or imprisonment of up to seven years or both.

• Hosted billing and RADIUS platforms. A subscriber management or authentication system running on servers outside Zimbabwe is a continuing transfer, not a one-off event.
• Network monitoring and NMS tooling. Monitoring platforms that ingest per-subscriber data and are operated from abroad.
• Upstream and transit providers. Where a capacity provider or regional parent can access subscriber-level records rather than aggregate traffic.
• Support desks and CRM. Cloud ticketing and CRM tools holding customer names, addresses and support histories.
• Group access. A regional head office able to log in and read Zimbabwean subscriber data is sharing that data outside Zimbabwe even if nothing is exported.

None of this means those platforms cannot be used. It means the intention is notified, the arrangement is papered under section 10(4)(f), and your subscriber notice honestly describes where the data goes.

Which tier an operator falls into

The count that sets your tier is data subjects, meaning people, not employees and not customers alone. It includes current and former staff, seasonal and casual workers, customers, enquirers who never bought, suppliers and their contact people, and anyone on a mailing list. Most organisations that assume they are small find they cross a tier boundary once the count is done properly, which is one of the things the consultation settles before anything is filed.

For an operator the count is dominated by subscribers and by everyone named on a subscriber account, plus former subscribers whose records are still held. Because churn accumulates, an ISP that currently serves a few thousand active customers can be holding data on considerably more people than that. Hotspot and captive portal registrations count too, and they are the records operators most often forget they have.

An operator processing for more than 500,000 data subjects sits in Tier 4. Between the active base, the churned base and public wifi sign-ups, national operators reach that faster than they expect, which is another reason to have a retention rule that is actually applied.

Where operators most often come up short

• Assuming the telecoms licence covers it. The gap this whole page exists to close, and by some distance the most common one.
• No written agreements with processors. Section 10(4)(f) requires a written data processing agreement with each processor. The billing platform, the hosted RADIUS, the ticketing system, the SMS gateway and the outsourced call centre are all processors, and most operators have papered none of them.
• Captive portal data with no notice and no purpose. Phone numbers harvested at a hotspot, later used for marketing that the person never agreed to.
• Support staff with unrestricted subscriber lookup. Everyone on the helpdesk able to pull any customer’s records and session history, with no access log.
• Indefinite log retention. Kept because nobody decided to stop, which raises the tier and widens the blast radius of any breach.
• Installation photographs and site surveys. Images of customers’ homes, sometimes with people in them, stored on installers’ personal phones.
• Cross-border platforms never notified. Years of hosted billing with no notification of the intention to transfer under section 10(2)(c).
• No breach procedure against a twenty four hour clock. Section 19 of the Act gives twenty four hours from any security breach affecting the data you process, and a network operator is a more likely target than most.

How StoneGuard gets it done

• Consultation. A $90 consultation opens the engagement. We work out what personal data you hold, which POTRAZ tier you fall into and what is missing. The fee is credited in full toward your package when you proceed.
• Gap analysis. A certified Data Protection Officer assesses your organisation against the Cyber and Data Protection Act on the StoneGuard platform and gives you a scored report with the gaps ranked.
• Licensing. We prepare and file your Data Controller licence application and your DPO appointment notification, and we handle the correspondence with POTRAZ until the licence is granted.
• Documentation. Your record of processing activities, privacy policy, consent wording, breach response procedure and data subject request procedure are drafted and put in place.
• Training. Staff training is delivered, which CDPG 1 of 2025 makes mandatory for licensed data controllers.
• Ongoing DPO. A certified Data Protection Officer stays on record for you after the licence is granted, keeps the registers current, handles data subject requests and breaches, files the annual renewal and attends POTRAZ inspections.

POTRAZ fees are paid to POTRAZ at cost, ex VAT, and are separate from the StoneGuard service fee. You will always see two numbers, never one blended figure.

Frequently asked questions

Get licensed and inspection ready

A $90 consultation opens the engagement and is credited in full toward your package when you proceed. Compliance packages start at $250. POTRAZ fees are separate and are paid to POTRAZ at cost, ex VAT.

Contact StoneGuard: email [email protected], WhatsApp +263 77 272 4514, or call +263 77 143 6742. StoneGuard is based in Harare, Zimbabwe.