StoneGuard › POTRAZ licence

POTRAZ Data Controller licence: how to register, requirements and fees

A POTRAZ Data Controller licence is the registration every organisation in Zimbabwe that holds personal data must obtain under Statutory Instrument 155 of 2024. You apply on Form DP1, notify your Data Protection Officer on Form DP2, and pay a licence fee of $50 to $2,500 ex VAT depending on how many records you hold. StoneGuard prepares and files the whole application.

Last reviewed 2 September 2026.

What the Data Controller licence is

A data controller is any organisation that decides what personal data is collected and what happens to it. Statutory Instrument 155 of 2024, made under the Cyber and Data Protection Act [Chapter 12:07], requires every organisation that holds personal data to license with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as a data controller.

The licence is issued to a legal entity. A group of companies does not hold one licence between them. Each registered entity that acts as a data controller applies in its own name, and each one is inspected in its own name.

The licence runs for twelve months and is renewed annually. Renewal is a filing, and the POTRAZ fee is paid again at cost.

How to register, step by step

Establish your tier. Count the personal data records you hold, your sites and your staff. The record count sets your POTRAZ tier, which sets your licence fee and whether the application fee applies.
Appoint a Data Protection Officer. Identify the person who will be your DPO. They need the relevant qualifications and their certificates form part of the filing. At Tier 1 a DPO is required only where you process sensitive data such as health, children or biometric data.
Assemble the supporting documents. Certificate of incorporation, trust deed or constitution, showing your exact registered name. The DPO designate national ID copy and their professional or DPO certificates. Your entity particulars: physical address, contact person, email and phone.
Pay the application fee if it applies. The $30 application fee, ex VAT, applies from Tier 2 upward. It does not apply at Tier 1 and it does not apply on renewals. Keep the proof of payment, it goes in with the application.
File Form DP1 and Form DP2. Form DP1 is the Data Controller licence application. Form DP2 notifies POTRAZ of your DPO appointment. Both forms are obtained from the POTRAZ website and are submitted together as one PDF to the Data Protection Authority, or delivered in hard copy.
Pay the licence fee on approval. The licence fee is paid once the application is approved, not before. A resubmission is filed as a complete new set, marked as a resubmission.

What you need before you file

Late document requests are the usual reason a filing stalls. This is the full set, collected at the start:

Exact registered entity name. The name on the certificate of incorporation, trust deed or constitution, not the trading or brand name. This is the name that appears on the licence.
DPO designate details. Full name, national ID copy, and educational or professional certificates evidencing their data protection qualification.
Entity particulars. Physical address, contact person, email address and telephone number for Form DP1.
Tier inputs. Record count, number of sites and number of staff. These determine the tier and the fee.
Proof of payment. Proof of the $30 application fee, for Tier 2 and above.

POTRAZ Data Controller licence fees

POTRAZ fees are paid to POTRAZ directly at cost, ex VAT. POTRAZ adds VAT on its own invoice. The $30 application fee applies from Tier 2 upward and is not charged at Tier 1 or on renewals.

These are government fees paid to POTRAZ. The StoneGuard service fee is separate and is never blended into the same figure.
Tier	Records held	Licence fee (ex VAT)	Application fee (ex VAT)
Tier 1	Up to 1,000 records	$50	Not applicable
Tier 2	Up to 100,000 records	$300	$30
Tier 3	Up to 500,000 records	$500	$30
Tier 4	Over 500,000 records	$2,500	$30

What StoneGuard does for the application

A certified Data Protection Officer runs the filing for you. The service fee is separate from the POTRAZ fees above. Packages start at $250, and the $90 consultation that opens the engagement is credited in full toward the package.

Gap analysis against the Cyber and Data Protection Act, scored and reported.
Form DP1 licence application prepared and filed.
Form DP2 DPO appointment notification prepared and filed.
Record of processing activities, privacy policy and consent wording drafted.
Breach response and data subject request procedures put in place.
Staff training delivered, as required under CDPG 1 of 2025.
Correspondence with POTRAZ handled until the licence is granted.

Frequently asked questions

How do I register as a data controller with POTRAZ in Zimbabwe?

You apply on Form DP1, obtained from the POTRAZ website, and notify your Data Protection Officer appointment on Form DP2. The two forms are submitted together with your certificate of incorporation, the DPO designate identification and certificates, your entity particulars, and proof of payment of the application fee where it applies. The licence fee is paid once the application is approved.

What is the POTRAZ data controller licence fee?

Ex VAT, the licence fee is $50 at Tier 1 for up to 1,000 records, $300 at Tier 2 for up to 100,000 records, $500 at Tier 3 for up to 500,000 records and $2,500 at Tier 4 for over 500,000 records. A $30 application fee applies from Tier 2 upward.

Is there an application fee at Tier 1?

No. The $30 application fee applies from Tier 2 upward. It is not charged at Tier 1, and it is not charged on renewals at any tier.

What are Form DP1 and Form DP2?

Form DP1 is the application for a Data Controller licence. Form DP2 is the notification of your Data Protection Officer appointment. Both are obtained from the POTRAZ website and are filed together as a single submission to the Data Protection Authority.

Do I need a separate licence for each of my companies?

Yes. POTRAZ licenses the legal entity. Each separate registered entity that acts as a data controller applies in its own name, under its own exact registered name, and holds its own licence.

Does the licence expire?

The Data Controller licence runs for twelve months and is renewed annually. The renewal is a filing and the POTRAZ fee is paid again at cost. The application fee does not apply on renewals.

Get licensed and inspection ready

A $90 consultation opens the engagement and is credited in full toward your package when you proceed. Compliance packages start at $250. POTRAZ fees are separate and are paid to POTRAZ at cost, ex VAT.

Contact StoneGuard: email [email protected], WhatsApp +263 77 272 4514, or call +263 77 143 6742. StoneGuard is based in Harare, Zimbabwe.