Guides, sector briefs and the DP1 form — read before you act.
Plain-language guidance on the Cyber and Data Protection Act, sector-specific briefs, and the DP1 data controller licence application form. Every claim cites the source.
DP1 application form
Fillable, printable and downloadable. The data controller licence application form under the Cyber and Data Protection Act.
Guides & explainers
Licensing of data controllers — CDPG 1 of 2025
What processing covers, who counts as a data subject, and the four licence categories under the Cyber and Data Protection Act.
What POTRAZ actually inspects — and what they ask for first
Inspections are announced and risk-based from 1 September 2026. Here is what the inspector asks for first, second and third — and what to do this month.
What is a data controller? A plain-language answer
The test is who decides the purposes, not who owns the server. Why the classification decides every obligation that follows.
Data protection for churches and ministries in Zimbabwe
A church holds more personal data than it thinks — and some of it is special personal information. Religious organisations are in the first inspection group.
What schools must do before the September inspections
Children's data carries heightened protection. Here are the gaps we see most in schools — and a workable checklist for heads and bursars.
What does a Data Protection Officer actually do?
The role in one sentence, the day-to-day work, whether it can be filled internally, and the common failure mode of quiet delegation.
Licensing as a data controller: the steps in order
Establish you are a controller, map what you process, fix the gaps, file with POTRAZ, and keep the position alive as systems change.
Sector briefs
Banks & financial institutions
Account records, KYC files and transaction histories.
Microfinance & SACCOs
Member savings records and guarantor details, often held on spreadsheets with no access controls.
Insurance & brokers
Claims files routinely contain health data, which is special personal information under the Act.
Local authorities & councils
Ratepayer databases, licensing records and residents’ contact details held indefinitely.
Healthcare providers
Patient records are special personal information; consent and retention rules are stricter.
Mining enterprises
Employee biometrics, medical surveillance data and contractor records across multiple sites.
Churches & ministries
Membership rolls, giving records and pastoral notes — personal data, whether or not you call it that.
Schools, colleges & universities
Learner records concern children, who receive heightened protection under the Act.
Government ministries & agencies
Citizen data at scale, with statutory duties that go beyond ordinary controllers.
NGOs & PVOs
Beneficiary data is often sensitive and shared with donors across borders.
Retail, supermarkets & wholesale
Loyalty programmes and CCTV footage are both regulated personal data.
Hospitality, hotels & tourism
Guest registers, passport scans and booking histories retained far longer than needed.
Telecoms & ISPs
Subscriber data and traffic records sit under both licensing regimes at once.
Technology, software & fintech
Processor for clients and controller for staff — both need addressing.
Transport, logistics & couriers
Delivery addresses, recipient names and vehicle tracking on drivers.
Agriculture & agribusiness
Outgrower schemes hold farmer identity and payment data at real scale.
Manufacturing & industrial
Shift records, biometric clocking and occupational health files.
Construction & real estate
Tenant applications, credit checks and site access registers.
Legal practices
Client files are confidential and personal data — privilege does not exempt you.
Accounting, audit & advisory
You process payroll and personal financial data for every client you serve.
Recruitment, HR & payroll
Your entire product is other people’s personal data. Expect scrutiny.
Media, publishing & advertising
Source data, subscriber lists and audience profiling all fall in scope.
Security services
Access logs, guard vetting files and surveillance footage.
Debt collection & credit bureaux
Financial history data with a direct effect on people’s lives — high sensitivity.
Sports clubs & gyms
Member health declarations and biometric entry systems.
Funeral services
Deceased and next-of-kin records, often held in unsecured paper files.
Motor dealerships
Finance applications, identity documents and service histories.
Utilities & energy
Household consumption data linked to named account holders.
Professional associations
Member registers, CPD records and disciplinary files.
Small & medium enterprises
Even a handful of staff records brings you inside the Act. Size is not an exemption.