zimbabwe
SI 155 in plain English
Updated 19 Jul 2026
SI 155 in plain English
Statutory Instrument 155 of 2024 is the regulation that operationalises the Cyber and Data Protection Act [Chapter 12:07]. It answers the "how" the Act left open: how to register with POTRAZ, how to appoint a DPO, how to notify a breach.
What it actually requires
- Licensing. Any organisation that processes personal information must be licensed by POTRAZ. Fees are tiered by the number of data subjects — from USD 50 (T1) to USD 2 500 (T4), all exclusive of 15.5% VAT.
- DPO appointment. Every controller must appoint a Data Protection Officer within 90 days of registration.
- Certification within six months. Certain controllers must have their DPO certified within six months of appointment. Certification is scarce and expensive — plan for it.
- Breach clocks. 24 hours to notify POTRAZ; 72 hours to notify affected data subjects.
What it does not do
SI 155 does not replace the Act. Rights (access, rectification, erasure) still live in the Act itself. The Regulations only fill in procedure.
Where to read it
Full text on VeritasZim — Cyber and Data Protection Act & SI 155.
Looking for something practical? Explore the free privacy tools.