POTRAZ Data Protection Compliance for Healthcare Providers in Zimbabwe
Avalon Health provides POTRAZ Cyber and Data Protection Act (Chapter 12:07) compliance and outsourced Data Protection Officer (DPO) services for Zimbabwean healthcare providers, including clinics, pharmacies, hospitals, laboratories and radiology centres. Data Controller licensing starts from $250 before the 1 September 2026 inspections begin, with healthcare in the first wave.
What the Cyber and Data Protection Act now requires
Under the Cyber and Data Protection Act (Chapter 12:07), SI 155 of 2024 and CDPG 1 of 2025, Zimbabwean healthcare providers must meet the following obligations before the 1 September 2026 POTRAZ inspections. Avalon Health prepares and files each one.
Data Controller licence
Registering as a licensed Data Controller with POTRAZ is now mandatory under SI 155 of 2024. Operating without one is an offence.
A Data Protection Officer is required
Under SI 155 a Data Protection Officer is a condition of holding a Data Controller licence. You cannot be licensed without one, so the only question is how your DPO is provided.
Records of Processing (ROPA) + notification
You must document what patient data you hold, why, and for how long, and notify POTRAZ of your processing activities.
DPIA for high-risk health data
A Data Protection Impact Assessment is required where you process sensitive health data at scale or in high-risk ways.
Privacy, breach & DSAR procedures
You need a published privacy policy plus written procedures for data breaches and patient data-access requests.
Physical & paper records security
Inspectors check paper files too. Filing rooms, registers and archives must be secured and access controlled.
Mandatory staff training
Staff who handle patient data must be trained under CDPG 1 of 2025, the POTRAZ assessment guidelines. Inspectors ask for training records, and we run sessions off-hours so clinic hours are not disrupted.
Secure patient data in transit
Sending patient details over ordinary email or WhatsApp is one of the most common inspection findings. Health data needs a secure channel, encrypted devices and documented safeguards.
Compliance packages and prices
One-off service fees. A mandatory consultation of $90 begins any engagement and is credited toward your package if you proceed. Avalon Health members save 10% on the service fee.
Starter · Get Licensed: $250 (one-off service fee)
For: Solo clinics, pharmacies, small labs & radiology
Everything you need to get licensed and pass a first inspection.
Deliverables
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- Privacy policy
- POTRAZ processing notification
- Basic Records of Processing (ROPA)
- Physical records security checklist
- DPO appointment guidance
Pro · Inspection-Ready: $650 (one-off service fee)
For: Group practices, pharmacy chains, small & mid hospitals, busy labs
Full documentation and assessments so an inspector finds nothing missing.
Deliverables
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- Privacy policy
- POTRAZ processing notification
- Basic Records of Processing (ROPA)
- Physical records security checklist
- DPO appointment guidance
- Data Protection Impact Assessment (DPIA, with legitimate interest and transfer assessments)
- Full ROPA
- Data breach response procedure
- Data subject access request (DSAR) procedure
- Staff training, up to 10 people (mandatory under CDPG 1 of 2025)
- Third-party DPAs and data sharing agreements
- Prioritised remediation plan (secure communications, device encryption)
Enterprise: from $1,500 (one-off service fee)
For: Hospital groups, multi-site providers, medical aids
Audit, multi-site rollout and ongoing reviews for complex organisations.
Deliverables
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- Privacy policy
- POTRAZ processing notification
- Basic Records of Processing (ROPA)
- Physical records security checklist
- DPO appointment guidance
- Data Protection Impact Assessment (DPIA, with legitimate interest and transfer assessments)
- Full ROPA
- Data breach response procedure
- Data subject access request (DSAR) procedure
- Staff training, up to 10 people (mandatory under CDPG 1 of 2025)
- Third-party DPAs and data sharing agreements
- Prioritised remediation plan (secure communications, device encryption)
- Full CDPA compliance audit
- Multi-site rollout
- Board + all-staff training
- Cross-border data transfer notifications
- Quarterly compliance reviews
POTRAZ government fees (paid at cost)
Government fees are separate from the service fee and billed at cost: a $30 POTRAZ application fee plus a Data Controller licence fee that scales with how many patient records you hold.
| POTRAZ tier | Records held | Licence fee |
|---|---|---|
| Tier 1 | Up to 1,000 records | $50 |
| Tier 2 | 1,001 – 100,000 records | $300 |
| Tier 3 | 100,001 – 500,000 records | $500 |
| Tier 4 | Over 500,000 records | $2,500 |
Data Protection Officer (DPO) retainers
Under SI 155 of 2024 a Data Protection Officer is a condition of holding a Data Controller licence, so a DPO is required, not optional. You can appoint your own, or Avalon Health can be your DPO on record. Retainers are billed monthly, quarterly at three months, or bi-annually at five months for six, which is where the discount applies.
Outsourced DPO
A named DPO on record with shared capacity. The right fit for most organisations.
| Size tier | Monthly | Quarterly | Bi-annual |
|---|---|---|---|
| Tier 1 (Up to 1,000 records) | $70/month | $210 quarterly | $350 bi-annual (pay 5, get 6) |
| Tier 2 (1,001 – 100,000 records) | $150/month | $450 quarterly | $750 bi-annual (pay 5, get 6) |
| Tier 3 (100,001 – 500,000 records) | $250/month | $750 quarterly | $1,250 bi-annual (pay 5, get 6) |
| Tier 4 (Over 500,000 records) | $400/month | $1,200 quarterly | $2,000 bi-annual (pay 5, get 6) |
Dedicated DPO
A proactive DPO embedded with your team, for larger or higher-risk providers.
| Size tier | Monthly | Quarterly | Bi-annual |
|---|---|---|---|
| Tier 1 (Up to 1,000 records) | $300/month | $900 quarterly | $1,500 bi-annual (pay 5, get 6) |
| Tier 2 (1,001 – 100,000 records) | $450/month | $1,350 quarterly | $2,250 bi-annual (pay 5, get 6) |
| Tier 3 (100,001 – 500,000 records) | $550/month | $1,650 quarterly | $2,750 bi-annual (pay 5, get 6) |
| Tier 4 (Over 500,000 records) | $1,100/month | $3,300 quarterly | $5,500 bi-annual (pay 5, get 6) |
Full-time DPO
For organisations that want a full-time DPO on record. Priced per engagement.
Priced per engagement (by quote).
We have our own DPO
You already have a Data Protection Officer, so no retainer is added.
Technical controls Avalon Health already provides
Avalon Health members already have the platform-level controls inspectors look for:
- PII tokenised at rest
- AES-256 encryption
- Append-only audit logging
- Role-based access control
- Multi-factor authentication
- Consent capture
Frequently asked questions
Do I really need a licence?
Yes. Under SI 155 of 2024 every healthcare organisation that holds patient data must register as a licensed Data Controller with POTRAZ. From 1 September 2026 inspectors can check this, and operating unlicensed is an offence. We prepare and file the application for you.
Do I have to have a DPO?
Yes. Under SI 155 of 2024 a Data Protection Officer is a condition of holding a Data Controller licence, so a DPO is required, not optional. The only choice is how your required DPO is provided. You can appoint your own, or we can be your DPO on record on an Outsourced, Dedicated or Full-time engagement, priced by your size tier. Retainers are billed monthly, quarterly at three months, or bi-annually at five months for six, which is where the discount applies.
What are the POTRAZ fees?
The government fees are separate from our service fee and are billed at cost. There is a $30 application fee, plus a Data Controller licence fee that scales with how many records you hold, from $50 for the smallest providers up to $2,500 for the largest.
How long does it take?
Most solo clinics and pharmacies are documented and filed within one to two weeks. Larger group practices and hospitals take a little longer because of the audit and multi-site work, but we build a timeline to have you inspection-ready before the deadline.
What about my paper files?
Paper records are in scope. Inspectors look at filing rooms, patient registers and archives. Every package includes a physical records security checklist so your paper files meet the same standard as your digital ones.
What does the DPO retainer actually cover?
The retainer is your required DPO on record plus the recurring compliance work: breach and incident response, handling patient data requests, quarterly records updates and notifications to POTRAZ, a six-month internal review, and the annual audit, policy review and training refresher. One-off projects, like an impact assessment for a brand new system, are quoted separately.
What if I miss the 1 September deadline?
Once inspections begin, being unlicensed or undocumented exposes you to enforcement action and penalties under the Act. The safest path is to get licensed and inspection-ready now. If you have already missed a step, we can fast-track the essentials first.
Talk to Avalon Health about compliance
Book a consultation to get licensed and inspection-ready before 1 September 2026. The consultation fee of $90 is credited toward your package if you proceed. Reach us on WhatsApp at +263772724514 or book a call at https://calendly.com/avalonhealth/30min.