Potraz data licence fees spark backlash over cost burden

The government's decision to require organisations that process personal data to obtain annual licences from the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) has drawn sharp criticism, with analysts warning that the compliance costs could impose a heavy financial burden on businesses, churches, schools and civic organisations while ultimately pushing up prices for consumers.

The concerns follow the publication of Regulatory Notice 2 of 2026, under which POTRAZ announced that mandatory compliance inspections and assessments of data controllers will begin on September 1, 2026, in terms of the Cyber and Data Protection Act.

Under Statutory Instrument 155 of 2024, organisations processing the personal data of 50 or more individuals are required to obtain a data controller licence from POTRAZ.

The law applies to organisations that collect or process personal information, including names, addresses, telephone numbers, national identity numbers, employment records, health information and biometric data.

Although the licensing requirement came into effect in September 2024, with organisations expected to comply by March 12, 2025, many are believed to have not yet registered.

The licensing framework forms part of the Cyber and Data Protection Act, which designates POTRAZ as Zimbabwe's Data Protection Authority.

Government says the regulations are intended to strengthen the protection of personal information and improve accountability in the handling of sensitive data amid increasing concerns over cybercrime, identity theft and data breaches.

However, the commencement of inspections has raised concerns about whether thousands of organisations fully understand that they fall within the scope of the law.

Schools maintaining class registers, churches keeping membership records, medical practices with patient files and retailers operating customer databases could all be required to obtain licences if they process the personal information of at least 50 individuals.

While the legislation provides exemptions for personal or household use, law enforcement activities and certain journalistic, historical or archival functions, organisations operating in some of those areas may still be required to register under the regulatory framework.

Under the fee structure, organisations processing data for between 50 and 1,000 people pay an annual licence fee of US$50. Those handling between 1,001 and 100,000 records pay US$300 plus a US$30 application fee, while organisations with larger databases pay between US$500 and US$2,500 depending on the volume of data processed.

The licence fee, however, represents only part of the compliance cost.

Every registered organisation is required to appoint a certified Data Protection Officer and notify POTRAZ. Certification currently costs US$1,250, excluding a US$30 application fee, meaning even a small organisation paying the minimum licence fee could face first-year compliance costs exceeding US$1,300 unless it appoints an external consultant.

Failure to comply carries severe penalties. Organisations processing personal data without a licence risk a Level 11 fine, imprisonment of up to seven years for their chief executive officer, or both.

Similar penalties apply to organisations that fail to adequately safeguard personal information, while any data breach must be reported to POTRAZ within 24 hours, with affected individuals notified within 72 hours.

Legal expert Dr Vusumuzi Sibanda said that while regulating the use of personal information is standard international practice, Zimbabwe's licensing model and associated fees raised serious concerns.

"The control of personal information is something that happens across the world to make sure that personal information is not abused or used beyond the interests of the owners of that information," he said.

"But what is new and strange is the need for registration and licence fees so that organisations must register. You can make sure people comply when they keep information without forcing companies to register and pay licence fees."

Dr Sibanda argued that government could enforce compliance with data protection standards without introducing what he described as an expensive licensing regime.

He said the regulations extended far beyond large corporations to churches, schools and voluntary organisations that collect only basic membership information.

"Imagine having licences for churches and voluntary organisations simply because they handle personal information," he said.

"In church, how do people really handle personal information? They don't require identity documents in most cases because membership is voluntary. Why would you require those organisations to make such payments?"

He warned that the regulations could eventually affect community-based organisations such as burial societies, savings clubs and other informal associations that maintain membership records.

Dr Sibanda also questioned whether the licensing framework was motivated by data protection concerns or revenue generation.

"It is something one can see as a desperate means of raising money from people. Unfortunately, it is very sad from where I'm looking at it. I think the government has run out of ideas," he said.

Another analyst, Mxolisi Ncube, warned that businesses and other organisations were likely to pass the cost of compliance on to consumers.

"Complying with these rules costs stakeholders a lot of money, meaning people must expect more expensive airtime, data and other charges," he said.

While government maintains that the regulations are necessary to improve privacy protections and accountability in the handling of personal information, critics argue that the high cost of compliance risks undermining those objectives by placing an excessive financial burden on organisations, particularly small businesses, churches, schools and community groups.

With mandatory inspections set to begin in September, thousands of organisations now face the choice of absorbing significant compliance costs or risking substantial fines and possible criminal prosecution for failing to comply with the new regulatory regime.