SI 155 of 2024 explained, section by section

What SI 155 of 2024 actually is

Its full name is the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024. It was made by the Minister responsible for information and communication technologies, in consultation with the Authority, under section 32 of the Cyber and Data Protection Act [Chapter 12:07].

The distinction between the Act and the regulation is worth holding on to, because they do different jobs. The Act sets out the principles: what personal data is, how it may be processed, what a data subject is entitled to, what security you owe. Statutory Instrument 155 of 2024 is the machinery: who has to apply for a licence, on which form, in which tier, at what fee, by when, and what happens if you do not.

A third document, CDPG 1 of 2025, sits alongside them and is where the mandatory training obligation for licensed controllers comes from.

Who has to license (sections 3 and 4)

Section 3(1) is blunt: no person shall process personal information for the purposes set out in section 3(2) unless they are licensed with the Authority. Section 3(2) then describes those purposes by intention rather than by industry.

• You decide the means, purpose or outcome of the processing. If you are the one who settles what happens to the data, you are in scope.
• You decide what personal data should be collected. Choosing the fields on the form is a controller decision.
• You decide which individuals to collect personal data from. Choosing whose data you gather is a controller decision.
• You obtain a commercial gain or other benefit from the processing. Note "or other benefit". A non profit that benefits from holding beneficiary data is not outside this because it makes no profit.

Section 4(1) repeats the duty in the classic formulation: any person, whether alone or jointly with others, who determines the purposes and means of the processing of personal data shall apply for a data controller licence. There is no size floor written into either section, and no exemption for small companies, charities or voluntary bodies.

The four licence categories (section 6)

Section 6 sets the categories by the number of data subjects whose information you process. The fee follows the category, so the tier decision is the fee decision.

The count that sets your tier is data subjects, meaning people, not employees and not customers alone. It includes current and former staff, seasonal and casual workers, customers, enquirers who never bought, suppliers and their contact people, and anyone on a mailing list. Most organisations that assume they are small find they cross a tier boundary once the count is done properly, which is one of the things the consultation settles before anything is filed.

One drafting point that comes up constantly is worth naming honestly. Tier 1 is written as a minimum of 50 and a maximum of 1,000 data subjects, so a controller processing for fewer than 50 people fits none of the four defined categories, while the duty to apply in sections 3 and 4 carries no size floor at all. That is a gap in the regulation rather than an exemption, and a genuinely very small body should get a considered answer on it rather than assume either way.

The forms, and the deadlines attached to them

SI 155 carries four schedules, and three of them are forms you will actually use.

1. Apply on Form DP1. Section 4(2) requires a written application in Form DP1, submitted to the Authority together with the fee specified in the Second Schedule.
2. POTRAZ responds within 14 days. Section 4(3) gives the Authority fourteen days to do one of three things: request further information or supporting documents, issue the licence, or reject the application and give reasons.
3. The licence may carry conditions. Section 4(4) allows the Authority to issue a licence with such conditions as it may specify, and section 5(1) makes the twelve month validity subject to compliance with those conditions.
4. Appoint a DPO within 90 days. Section 12(5) requires a Data Protection Officer to be appointed within ninety days of promulgation, or of the termination of a previous officer’s contract.
5. Notify the DPO on Form DP2. Section 12(1) and 12(2) require the appointment to be notified to the Authority in writing, in Form DP2.
6. Keep the notification current. Section 12(3) requires any change to the officer’s phone number, email address or physical address to be notified within fourteen days, and section 12(4) requires notice of a dismissal or resignation within fourteen days of termination.
7. Renew three months early. Section 5(2) requires a renewal application, again on Form DP1 and again with the fee, at least three months before the licence expires.

What section 10 puts on the controller

Section 10 is the substantive obligations section, and it is the one most likely to be quoted back at an organisation during an inspection. It has two halves: things you must tell the Authority, and things you must do.

• Notify your processing activities. Section 10(2)(a) requires notification of all processing activities performed on personal information.
• Notify indirect collection changes. Section 10(2)(b) covers any modification of personal information collected indirectly from data subjects.
• Notify cross border intentions. Section 10(2)(c) requires you to notify any intention to transfer or share data subject information outside Zimbabwe. Note that it is the intention that is notifiable, not the transfer after the fact.
• Notify biometric and genetic processing. Section 10(2)(d) singles out processing involving biometric and genetic data of data subjects.
• Train your officer, continuously. Section 10(1) requires the controller to provide continuous professional development training to the Data Protection Officer, to maintain that officer’s certification.
• Contract with every processor in writing. Section 10(4)(f) requires a written data processing agreement, contract or legal instrument with each data processor, ensuring the processor maintains the necessary security measures.
• Carry the can for everyone downstream. Section 10(4)(a) makes the controller accountable for a representative, agent, assignee, data processor, recipient or data protection officer who contravenes the regulations or the Act.
• No solely automated decisions with legal effect. Section 10(3) prohibits subjecting a data subject to a decision based solely on automated processing that produces legal effects, without their consent or a provision established by law.

The children’s data rules (section 10(5))

Section 10(5) is a separate regime inside section 10, and any school, paediatric practice, children’s ministry or child focused programme should read it as a checklist.

• Children’s personal information may not be processed without the consent of the parent or legal guardian.
• The controller must make reasonable efforts to verify that consent was given or authorised by the parent or guardian, taking available technology into account.
• All of the data processing principles apply, with attention rather than in outline.
• Regular data protection impact assessments must be conducted to identify and mitigate privacy risks to children.
• Data protection by design and by default must be ensured when processing children’s data.
• Children’s data may not be subjected to automated decision making that affects children’s rights.

Contravening section 10, including this subsection, is an offence under section 10(6) carrying a fine of up to level 11 or imprisonment of up to seven years or both.

The Data Protection Officer (sections 12, 13 and 14)

SI 155 does not simply say "appoint someone". It sets qualifications, requires certification, and lists the functions the officer must actually perform.

• Qualifications. Section 13(1) lists data science, data analytics, information security systems, information systems audit, law, audit or any other relevant qualification, together with knowledge of national data protection laws and practices and an understanding of the controller’s business operations and processing activities.
• Certification. Section 13(2) requires every officer to undergo a certification course approved by the Authority. Section 11(3) makes it an offence to provide that certification training without being accredited by the Authority.
• Functions. Section 14 lists monitoring compliance, managing internal data protection activities, raising awareness, training staff, conducting internal compliance audits, dealing with requests from the Authority and from data subjects, advising employees on their obligations, advising on and monitoring impact assessments, working with the Authority, and acting as the contact point for data subjects.
• The penalty is lighter, the exposure is not. Failing to appoint an officer is an offence under section 12(6), carrying up to level 7 or two years, which is lower than the level 11 offences. But an organisation without an officer tends to be an organisation without the registers, procedures and training the level 11 offences are about.

Who is exempt (section 8)

The exemptions are narrow, and they are the whole list. Section 8(1) exempts controllers processing personal data for personal, family or household affairs, for law enforcement, and for journalistic, historical or archival purposes.

Section 8(2) then qualifies two of those three. Law enforcement controllers and journalistic, historical or archival controllers are exempt from applying for a licence, but are still required to register with the Authority and to comply with the data protection principles under the Act. Only genuinely personal, family or household processing falls outside altogether.

It is worth saying plainly what is not on that list: there is no exemption for small businesses, for non profits, for churches, for schools, for sole traders or for organisations that hold data only on paper.

The offences SI 155 creates

The instruments express fines as a level on the standard scale rather than as an amount of money. The level is fixed in the law, but the value of each level is set by the standard scale and is revised from time to time, so the sensible thing is to confirm the current value rather than to rely on a figure quoted on a website. What is fixed, and what matters for planning, is the seriousness: these are criminal offences carrying prison terms, not administrative charges.

Frequently asked questions

Get licensed and inspection ready

A $90 consultation opens the engagement and is credited in full toward your package when you proceed. Compliance packages start at $250. POTRAZ fees are separate and are paid to POTRAZ at cost, ex VAT.

Contact StoneGuard: email [email protected], WhatsApp +263 77 272 4514, or call +263 77 143 6742. StoneGuard is based in Harare, Zimbabwe.