POTRAZ Data Protection Compliance for Healthcare Providers in Zimbabwe
Avalon Health provides POTRAZ Cyber and Data Protection Act (Chapter 12:07) compliance and outsourced Data Protection Officer (DPO) services for Zimbabwean healthcare providers, including clinics, pharmacies, hospitals, laboratories and radiology centres. Data Controller licensing starts from $250 before the 1 September 2026 inspections begin, with healthcare in the first wave.
What the Cyber and Data Protection Act now requires
Under the Cyber and Data Protection Act (Chapter 12:07), SI 155 of 2024 and CDPG 1 of 2025, Zimbabwean healthcare providers must meet the following obligations before the 1 September 2026 POTRAZ inspections. Avalon Health prepares and files each one.
Data Controller licence
Registering as a licensed Data Controller with POTRAZ is now mandatory under SI 155 of 2024. Operating without one is an offence.
A Data Protection Officer is required
Under SI 155 a Data Protection Officer is a condition of holding a Data Controller licence. You cannot be licensed without one, so the only question is how your DPO is provided.
Records of Processing (ROPA) + notification
You must document what patient data you hold, why, and for how long, and notify POTRAZ of your processing activities.
DPIA for high-risk health data
A Data Protection Impact Assessment is required where you process sensitive health data at scale or in high-risk ways.
Privacy, breach & DSAR procedures
You need a published privacy policy plus written procedures for data breaches and patient data-access requests.
Physical & paper records security
Inspectors check paper files too. Filing rooms, registers and archives must be secured and access controlled.
Mandatory staff training
Staff who handle patient data must be trained under CDPG 1 of 2025, the POTRAZ assessment guidelines. Inspectors ask for training records, and we run sessions off-hours so clinic hours are not disrupted.
Secure patient data in transit
Sending patient details over ordinary email or WhatsApp is one of the most common inspection findings. Health data needs a secure channel, encrypted devices and documented safeguards.
Compliance packages and prices
One-off service fees. A mandatory consultation of $90 begins any engagement and is credited toward your package if you proceed. Avalon Health members save 10% on the service fee.
Starter · Get Licensed: $250 (one-off service fee)
For: Solo clinics, pharmacies, small labs & radiology
Everything you need to get licensed and pass a first inspection.
Deliverables
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- POTRAZ processing notification
- Records of Processing (ROPA)
- Privacy policy and patient consent wording
- Data Protection Impact Assessment for health and minors’ data (standard form)
- Data breach response procedure
- Data subject access request (DSAR) procedure
- Physical records security checklist
- Staff data protection training, one session up to 5 people (CDPG 1 of 2025)
- DPO appointment guidance
Pro · Inspection-Ready: $650 (one-off service fee)
For: Group practices, pharmacy chains, small & mid hospitals, busy labs
Full documentation and assessments so an inspector finds nothing missing.
Deliverables
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- POTRAZ processing notification
- Records of Processing (ROPA)
- Privacy policy and patient consent wording
- Data Protection Impact Assessment for health and minors’ data (standard form)
- Data breach response procedure
- Data subject access request (DSAR) procedure
- Physical records security checklist
- Staff data protection training, one session up to 5 people (CDPG 1 of 2025)
- DPO appointment guidance
- Full DPIA with legitimate interest and transfer assessments
- Expanded ROPA across departments and systems
- Third-party DPAs and data sharing agreements
- Prioritised remediation plan (secure communications, device encryption)
- Staff training extended to 10 people across multiple sessions
- Cross-border transfer assessment
Enterprise: from $1,500 (one-off service fee)
For: Hospital groups, multi-site providers, medical aids
Audit, multi-site rollout and ongoing reviews for complex organisations.
Deliverables
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- POTRAZ processing notification
- Records of Processing (ROPA)
- Privacy policy and patient consent wording
- Data Protection Impact Assessment for health and minors’ data (standard form)
- Data breach response procedure
- Data subject access request (DSAR) procedure
- Physical records security checklist
- Staff data protection training, one session up to 5 people (CDPG 1 of 2025)
- DPO appointment guidance
- Full DPIA with legitimate interest and transfer assessments
- Expanded ROPA across departments and systems
- Third-party DPAs and data sharing agreements
- Prioritised remediation plan (secure communications, device encryption)
- Staff training extended to 10 people across multiple sessions
- Cross-border transfer assessment
- Full CDPA compliance audit
- Multi-site rollout
- Board + all-staff training
- Cross-border data transfer notifications
- Quarterly compliance reviews
POTRAZ government fees (paid at cost)
Government fees are separate from the service fee and billed at cost: a $30 POTRAZ application fee plus a Data Controller licence fee that scales with how many patient records you hold.
| POTRAZ tier | Records held | Licence fee |
|---|---|---|
| Tier 1 | Up to 1,000 records | $50 |
| Tier 2 | 1,001 – 100,000 records | $300 |
| Tier 3 | 100,001 – 500,000 records | $500 |
| Tier 4 | Over 500,000 records | $2,500 |
Data Protection Officer (DPO) retainers
Under SI 155 of 2024 a Data Protection Officer is a condition of holding a Data Controller licence, so a DPO is required, not optional. You can appoint your own, or Avalon Health can be your DPO on record. Retainers are billed monthly, quarterly at three months, or bi-annually at five months for six, which is where the discount applies.
Outsourced DPO
A named DPO on record with shared capacity. The right fit for most organisations.
| Size tier | Monthly | Quarterly | Bi-annual |
|---|---|---|---|
| Tier 1 (Up to 1,000 records) | $50/month | $150 quarterly | $250 bi-annual (pay 5, get 6) |
| Tier 2 (1,001 – 100,000 records) | $150/month | $450 quarterly | $750 bi-annual (pay 5, get 6) |
| Tier 3 (100,001 – 500,000 records) | $250/month | $750 quarterly | $1,250 bi-annual (pay 5, get 6) |
| Tier 4 (Over 500,000 records) | $400/month | $1,200 quarterly | $2,000 bi-annual (pay 5, get 6) |
Dedicated DPO
A proactive DPO embedded with your team, for larger or higher-risk providers.
| Size tier | Monthly | Quarterly | Bi-annual |
|---|---|---|---|
| Tier 1 (Up to 1,000 records) | $300/month | $900 quarterly | $1,500 bi-annual (pay 5, get 6) |
| Tier 2 (1,001 – 100,000 records) | $450/month | $1,350 quarterly | $2,250 bi-annual (pay 5, get 6) |
| Tier 3 (100,001 – 500,000 records) | $550/month | $1,650 quarterly | $2,750 bi-annual (pay 5, get 6) |
| Tier 4 (Over 500,000 records) | $1,100/month | $3,300 quarterly | $5,500 bi-annual (pay 5, get 6) |
Full-time DPO
For organisations that want a full-time DPO on record. Priced per engagement.
Priced per engagement (by quote).
We have our own DPO
You already have a Data Protection Officer, so no retainer is added.
Technical controls Avalon Health already provides
Avalon Health members already have the platform-level controls inspectors look for:
- PII tokenised at rest
- AES-256 encryption
- Append-only audit logging
- Role-based access control
- Multi-factor authentication
- Consent capture
Frequently asked questions
Do I really need a licence?
Yes. Under SI 155 of 2024 every healthcare organisation that holds patient data must register as a licensed Data Controller with POTRAZ. From 1 September 2026 inspectors can check this, and operating unlicensed is an offence. We prepare and file the application for you.
Do I have to have a DPO?
Yes. Under SI 155 of 2024 a Data Protection Officer is a condition of holding a Data Controller licence, so a DPO is required, not optional. The only choice is how your required DPO is provided. You can appoint your own, or we can be your DPO on record on an Outsourced, Dedicated or Full-time engagement, priced by your size tier. Retainers are billed monthly, quarterly at three months, or bi-annually at five months for six, which is where the discount applies.
What are the POTRAZ fees?
The government fees are separate from our service fee and are billed at cost with no markup. There is a $30 application fee from Tier 2 upward (no application fee applies at Tier 1), plus a Data Controller licence fee that scales with how many records you hold, from $50 for the smallest providers up to $2,500 for the largest. These POTRAZ figures are exclusive of VAT, which POTRAZ adds on its own invoice. That is why we quote our fee and the POTRAZ fees as two separate numbers and never give you a single all-in total: we will not quote you a figure that depends on a tax rate we do not set. You pay POTRAZ exactly what POTRAZ bills us. The licence renews annually at the tier fee, and we handle the renewal filing under your DPO retainer.
How long does it take?
Most solo clinics and pharmacies are documented and filed within one to two weeks. Larger group practices and hospitals take a little longer because of the audit and multi-site work, but we build a timeline to have you inspection-ready before the deadline.
What about my paper files?
Paper records are in scope. Inspectors look at filing rooms, patient registers and archives. Every package includes a physical records security checklist so your paper files meet the same standard as your digital ones.
What does the DPO retainer actually cover?
Every tier covers the same duties: your named certified DPO on record with POTRAZ, breach and incident on-call including the notifications if an incident is reportable, patient data requests handled end to end, your records kept current and processing changes notified to POTRAZ, a compliance report to management, the annual audit, policy review and training refresher, the annual licence renewal filing, and a POTRAZ inspection attended. What changes between tiers is the service limits, not the duties: a Tier 1 practice at $50 a month gets up to 2 data requests a quarter, next-working-day breach response and a six-monthly review, while larger tiers get faster response times, more frequent reviews and higher volumes. A smaller practice pays less because it is smaller, not because it is less covered. Work outside the retainer, such as an impact assessment for a brand new system or a material-change assessment, is quoted separately.
What happens in the compliance consultation?
The consultation is a one-hour working session at $90, at your practice or on a call. Our data protection officers confirm your controller status, map how patient records are held, stored and shared across your systems, and confirm your exact POTRAZ licence tier. From that we complete your assessment and issue an accurate quotation, and the $90 is credited in full toward your compliance package when you proceed.
How is my licence tier determined?
By the number of individuals whose personal data you hold in total, counting patients, staff and partners: Tier 1 up to 1,000 records, Tier 2 from 1,001 to 100,000, Tier 3 from 100,001 to 500,000, and Tier 4 above 500,000. Most solo and small practices fall in Tier 1. The consultation confirms your tier before anything is filed.
When do we sign a contract?
Straight after the consultation, together with your assessment and quotation. The agreement covers both sides: our obligations, your named certified DPO on record, deliverables and timelines, confidentiality, breach and incident response, and the POTRAZ filings, and yours, access to the information we need, a point of contact, and the agreed fees. Nothing beyond the $90 consultation is owed until you have read it and chosen a package.
What if I miss the 1 September deadline?
Once inspections begin, being unlicensed or undocumented exposes you to enforcement action and penalties under the Act. The safest path is to get licensed and inspection-ready now. If you have already missed a step, we can fast-track the essentials first.
Talk to Avalon Health about compliance
Book a consultation to get licensed and inspection-ready before 1 September 2026. The consultation fee of $90 is credited toward your package if you proceed. Reach us on WhatsApp at +263772724514 or book a call at https://calendly.com/avalonhealth/30min.