Data protection for retailers and wholesalers in Zimbabwe

Why a shop is a data controller

Retailers are among the last businesses to think of themselves as data holders, because the transaction that matters most to them, a cash sale to an anonymous walk-in, involves no personal data at all. Everything around that transaction does.

The moment you open an account, run a layby, extend credit, sign somebody up to a loyalty programme, take a delivery address, record a mobile money number or point a camera at the shop floor, you are processing personal data and the duty in section 4(1) attaches.

• Account and credit customers. Names, addresses, national identity numbers, employer details, payslips, guarantors, next of kin and payment histories. This is the richest and most sensitive file most retailers hold.
• Layby and hire purchase records. Long-running agreements with instalment histories and default records attached to a named person.
• Loyalty programmes. Membership data plus a purchase history, which together build a detailed profile of a household.
• Delivery and logistics data. Addresses, phone numbers, delivery instructions and sometimes GPS pins.
• Payment data. Mobile money numbers, card details where held, and bank details for refunds or debit orders.
• CCTV. Continuous footage of identifiable customers and staff, usually with no notice, no retention rule and no register entry.
• Marketing lists. Bulk SMS and WhatsApp broadcast lists, and the till prompt that asks for a phone number.
• Staff records. Payroll, identity documents, disciplinary matters, and biometric clocking systems at the staff entrance.

The credit book is the highest-risk file in the shop

Account and credit customer files carry more sensitive material than retailers generally appreciate. A credit application typically gathers an identity document, an employer, a salary figure, a payslip, a residential address, next of kin and one or two guarantors who never walked into the shop themselves but whose personal data you now hold.

Two obligations follow directly. The guarantors and next of kin are data subjects in their own right, with the same rights as the customer, and they are frequently people nobody told that a file exists. And section 10(3) of Statutory Instrument 155 of 2024 prohibits subjecting a data subject to a decision based solely on automated processing which produces legal effects concerning them, without their consent or a provision established by law.

That second point matters for any retailer running automated credit scoring or an automatic approval and decline rule. A credit refusal is a decision with a real effect on the person. If it is made solely by a system with no human involvement, section 10(3) is engaged and you need either consent or a legal basis, and in practice a documented point of human review is the simpler answer.

• Tell guarantors and next of kin. They are data subjects. A notice at the point their details are taken is the straightforward fix.
• Keep a human in the credit decision. A recorded human review step keeps you clear of the solely-automated prohibition and is easier to evidence than a consent trail.
• Restrict access to the credit file. A payslip and an identity document should not be readable by every till operator.
• Handle defaulters lawfully. Passing a customer to a debt collector is a disclosure to a third party. It needs a lawful basis, a written agreement with the collector under section 10(4)(f), and it never justifies publishing a defaulter’s details.
• Set a retention period. A settled account from years ago does not need to keep a copy of somebody’s identity document indefinitely.

CCTV and loyalty, the two everybody forgets

These are the two systems that generate the most personal data in a retail business and receive the least governance, because both are usually procured as security or marketing rather than as data processing.

• CCTV needs a notice. People should know they are being recorded, by whom, and why, before they are in the frame.
• CCTV needs a retention rule. Footage kept until the disk fills is not a retention policy. Decide a period, apply it, and record the decision.
• CCTV needs an access rule. Who can review footage, on what grounds, and with what record. Staff monitoring in particular needs to be proportionate and disclosed.
• CCTV belongs in the register. It is a processing activity, and section 10(2)(a) requires processing activities to be notified. It is routinely absent from retailers’ records of processing.
• Loyalty data is profiling. A purchase history tied to a named member reveals household composition, health indicators through pharmacy or baby purchases, and income patterns. Treat it accordingly.
• Marketing needs its own permission. A phone number given to complete a purchase was not given for bulk SMS. Marketing consent should be separate, recorded, and genuinely withdrawable, with an opt-out that works.

The third parties in a retail operation

Section 10(4)(f) of Statutory Instrument 155 of 2024 requires a written data processing agreement with each data processor. Retailers typically use more processors than almost any other kind of business, and typically have written agreements with none of them.

• The point of sale and stock system vendor, particularly where it is cloud hosted.
• The loyalty programme platform.
• The bulk SMS or WhatsApp messaging gateway.
• Delivery partners and third party couriers who receive customer names and addresses.
• Debt collectors and credit bureaux.
• The CCTV installer or monitoring company, where footage leaves your premises.
• The payroll bureau and the accounting practice.
• Any marketing agency running campaigns against your customer list.

Section 10(4)(a) makes the controller accountable for a representative, agent, assignee, processor, recipient or data protection officer who contravenes, and section 33(6) of the Act makes the controller liable for fines incurred by its agent or assignee. If your loyalty platform leaks, it is your notification and your exposure.

Which tier a retailer falls into

The count that sets your tier is data subjects, meaning people, not employees and not customers alone. It includes current and former staff, seasonal and casual workers, customers, enquirers who never bought, suppliers and their contact people, and anyone on a mailing list. Most organisations that assume they are small find they cross a tier boundary once the count is done properly, which is one of the things the consultation settles before anything is filed.

Retail counts climb faster than in almost any other sector, because a loyalty programme converts anonymous shoppers into named data subjects at scale and never lets them go. A single supermarket with a mature loyalty scheme can be well into Tier 3. A chain counts across the whole legal entity, not per branch.

Where a group operates several registered companies, each licenses in its own registered name. Where one company operates many branches, that is one licence covering the whole count.

Where retailers most often come up short

• CCTV with no notice, no retention rule and no register entry. The most consistent finding in the sector, and among the easiest to fix.
• Marketing to numbers collected at the till. Given for a receipt or a warranty, used for campaigns, with no separate permission and often no working opt-out.
• Credit files readable by everyone. Payslips and identity documents in a shared folder or an unlocked drawer behind the counter.
• No agreement with the loyalty or point of sale vendor. The party holding the largest customer database is usually on nothing more than a licence invoice.
• Customer lists on personal phones. Sales staff keeping their own WhatsApp customer lists, which walk out with them.
• Defaulters named publicly. Posting or circulating defaulter details is a disclosure with no lawful basis and a straightforward complaint waiting to happen.
• Guarantors who were never told. Their data is held, they have rights over it, and nobody ever gave them a notice.
• No retention rule anywhere. Account files, CCTV and loyalty histories accumulating indefinitely, raising the tier and the risk together.

How StoneGuard gets it done

• Consultation. A $90 consultation opens the engagement. We work out what personal data you hold, which POTRAZ tier you fall into and what is missing. The fee is credited in full toward your package when you proceed.
• Gap analysis. A certified Data Protection Officer assesses your organisation against the Cyber and Data Protection Act on the StoneGuard platform and gives you a scored report with the gaps ranked.
• Licensing. We prepare and file your Data Controller licence application and your DPO appointment notification, and we handle the correspondence with POTRAZ until the licence is granted.
• Documentation. Your record of processing activities, privacy policy, consent wording, breach response procedure and data subject request procedure are drafted and put in place.
• Training. Staff training is delivered, which CDPG 1 of 2025 makes mandatory for licensed data controllers.
• Ongoing DPO. A certified Data Protection Officer stays on record for you after the licence is granted, keeps the registers current, handles data subject requests and breaches, files the annual renewal and attends POTRAZ inspections.

POTRAZ fees are paid to POTRAZ at cost, ex VAT, and are separate from the StoneGuard service fee. You will always see two numbers, never one blended figure.

Frequently asked questions

Get licensed and inspection ready

A $90 consultation opens the engagement and is credited in full toward your package when you proceed. Compliance packages start at $250. POTRAZ fees are separate and are paid to POTRAZ at cost, ex VAT.

Contact StoneGuard: email [email protected], WhatsApp +263 77 272 4514, or call +263 77 143 6742. StoneGuard is based in Harare, Zimbabwe.