Do you need a DPO?

In Zimbabwe

Yes, in almost every case. The Cyber and Data Protection Act (s. 19) and SI 155 of 2024 require every registered controller to appoint a Data Protection Officer within 90 days of registration. The DPO can be internal or contracted, but the appointment must be notified to POTRAZ.

In the UK

Under UK GDPR Article 37, a DPO is mandatory when:

1. You are a public authority (courts excepted).
2. Your core activities require systematic monitoring of data subjects on a large scale.
3. Your core activities involve large-scale processing of special-category or criminal-conviction data.

If none apply, you may still appoint one voluntarily — many organisations do, because it clarifies accountability.

What the DPO actually does

• Monitors compliance with the Act / UK GDPR.
• Advises on Data-Protection Impact Assessments.
• Acts as the point of contact for the authority and data subjects.
• Reports to the highest level of management — not to a business unit that owns processing.

Independence is the whole point. A DPO who reports to the marketing team is a DPO in name only.