StoneGuard › What it costs
A POTRAZ data controller licence costs $50 at Tier 1, $300 at Tier 2, $500 at Tier 3 and $2,500 at Tier 4, ex VAT, set by how many data subjects you hold. A $30 application fee applies from Tier 2 upwards. StoneGuard packages start at $250 and are billed separately.
Last reviewed 2 September 2026.
There are two fees in the POTRAZ column and they behave differently. The application fee is paid once, when you apply. The licence fee is paid on the licence itself and falls due once your application is approved.
Your tier is not something you choose. Section 6 of Statutory Instrument 155 of 2024 sets four licence categories by the number of data subjects whose information you process, and the fee follows the category.
| Licence tier | Data subjects (SI 155 s6) | Licence fee (ex VAT) | Application fee |
|---|---|---|---|
| Tier 1 | Minimum 50, maximum 1,000 | $50 | Not applicable |
| Tier 2 | 1,001 to 100,000 | $300 | $30 |
| Tier 3 | 100,001 to 500,000 | $500 | $30 |
| Tier 4 | More than 500,000 | $2,500 | $30 |
POTRAZ fees are paid to POTRAZ at cost, ex VAT, and are separate from the StoneGuard service fee. You will always see two numbers, never one blended figure.
The application fee is $30 ex VAT. On the POTRAZ tax invoice it arrives as $34.65, because POTRAZ adds VAT on its own invoice at a rate it sets, not us.
Two things about it catch people out. It does not apply at Tier 1, so the smallest organisations pay the licence fee only. And it is not charged again when you renew, so it is a one off cost at the start rather than an annual line in your budget.
Under section 5 of Statutory Instrument 155 of 2024 a data controller licence is valid for twelve months, subject to your continuing compliance with the Act, the regulations and any conditions on the licence itself.
Renewal uses the same form as the original application, Form DP1, and it is not a thing to leave until the last week. The regulations require a renewal application to be submitted at least three months before the licence expires.
Missing the renewal is not a paperwork slip. Failing without just cause to renew by the expiry date is an offence in its own right under section 5(3), carrying the same maximum penalty as never having licensed at all.
The POTRAZ fees above buy you a licence. They do not produce the gap analysis, the record of processing activities, the privacy policy, the breach and data subject request procedures, the impact assessment or the staff training that the law also requires, and that an inspector will ask to see.
A $90 consultation opens the engagement and is credited in full toward your package when you proceed. Packages start at $250.
| StoneGuard fee | Amount | When |
|---|---|---|
| Consultation | $90 | Once, at the start, credited in full toward the package |
| Starter package | $250 | Once, small organisations on a single site |
| Pro package | $650 | Once, mid size, multiple departments or sites |
| Enterprise package | from $1,500 | Once, groups, high volumes, multi site rollout |
| DPO retainer | from $250 every six months | Ongoing, starts when the licence is granted |
The retainer is the part organisations forget when they budget. Licensing is a one off event, but the licence has to be renewed, the registers have to stay current, breaches have to be reported inside twenty four hours and an inspector will ask who your appointed officer is. The retainer is how that is covered through the year, and it starts at the smallest tier at $250 every six months.
The count that sets your tier is data subjects, meaning people, not employees and not customers alone. It includes current and former staff, seasonal and casual workers, customers, enquirers who never bought, suppliers and their contact people, and anyone on a mailing list. Most organisations that assume they are small find they cross a tier boundary once the count is done properly, which is one of the things the consultation settles before anything is filed.
The tier categories in section 6 formally begin at 50 data subjects. A controller holding fewer than that sits outside the defined categories, which is a gap in the drafting rather than an exemption, and it is worth getting a considered answer rather than a guess. The duty to apply in sections 3 and 4 is written broadly and the only exemptions in section 8 are personal, family or household affairs, law enforcement, and journalistic, historical or archival purposes. There is no small business exemption.
The POTRAZ licence fee is $50 at Tier 1, $300 at Tier 2, $500 at Tier 3 and $2,500 at Tier 4, all ex VAT, with the tier set by how many data subjects you process for. From Tier 2 upwards there is also a $30 application fee. Those fees are paid to POTRAZ. The StoneGuard work that gets you licensed and inspection ready is quoted separately, from $250.
Yes, from Tier 2 upwards. It is $30 ex VAT and appears on the POTRAZ tax invoice as $34.65 once VAT is added. It does not apply at Tier 1, and it is not charged again on renewal.
POTRAZ adds VAT on its own invoice. We quote every POTRAZ figure ex VAT so that our quote reconciles line by line against what POTRAZ bills you, and so you can see plainly that nothing has been added to it.
The licence is valid for twelve months under section 5 of Statutory Instrument 155 of 2024, so the licence fee recurs at renewal. The application fee does not. A renewal application has to go in at least three months before the licence expires.
Failing without just cause to renew by the expiry date is an offence under section 5(3) of Statutory Instrument 155 of 2024, carrying a fine of up to level 11 or imprisonment of up to seven years or both. It is treated as seriously as never having licensed.
No. POTRAZ fees are passed through at cost and paid by you directly to POTRAZ. You will always see two separate numbers from us, our service fee and the POTRAZ fees, and never one blended total that hides which is which.
For a small single site organisation at Tier 1: the $90 consultation, which is credited in full toward the $250 Starter package, so $250 of StoneGuard fees in total, plus $50 ex VAT of POTRAZ licence fee with no application fee at that tier. After licensing the DPO retainer starts, from $250 every six months at the smallest tier.
A $90 consultation opens the engagement and is credited in full toward your package when you proceed. Compliance packages start at $250. POTRAZ fees are separate and are paid to POTRAZ at cost, ex VAT.
Contact StoneGuard: email [email protected], WhatsApp +263 77 272 4514, or call +263 77 143 6742. StoneGuard is based in Harare, Zimbabwe.