Zimbabwe healthcare data protection

What POTRAZ Compliance Costs a Medical Practice or Clinic in Zimbabwe

A POTRAZ Data Controller licence costs a Zimbabwean healthcare provider $50 a year at Tier 1, up to 1,000 records, with no application fee. Tier 2, from 1,001 to 100,000 records, is $300 plus a one-off $30 application fee. All figures are exclusive of VAT and paid to POTRAZ at cost. Avalon Health charges its service fee separately.

Written by the Avalon Health data protection team. Last reviewed 2 September 2026.

The two numbers, and why we never merge them

There are always two separate figures in a healthcare compliance budget and we will never show you one blended total. The first is what you pay POTRAZ, which is a government fee that we pass through at cost and never mark up. The second is what you pay Avalon Health for the work of getting the practice licensed, documented and inspection-ready. Keeping them apart is how you can reconcile our quotation against the POTRAZ invoice line by line, and how you can see plainly that nothing has been added to the government fee.

POTRAZ figures are quoted exclusive of VAT throughout, because POTRAZ adds VAT on its own invoice at a rate we do not set. The $30 application fee, for example, arrives on the POTRAZ tax invoice as $34.65 once VAT is added.

The POTRAZ fees, tier by tier

Section 6 of SI 155 of 2024 sets four licence categories by the number of data subjects whose information you process, and the licence fee follows the category. Your tier is not something you choose or negotiate.

Two features of the application fee catch practices out. It does not apply at Tier 1 at all, so a solo practitioner pays the licence fee only. And it is not charged again on renewal at any tier, so it is a one-off cost at the start rather than an annual line in the practice budget.

Which tier a healthcare provider actually falls into

This is where money is genuinely won and lost, because the tier is set by a cumulative count of individuals and practices consistently undercount it. The count is people, not files or consultations: one patient with fifteen years of history is one data subject. But it includes everyone whose data you hold, not only the patients you are currently seeing.

• Current patients on the active list.
• Historical and dormant patients whose files are still in the archive, in any format.
• Patients of a practice you absorbed, whose records came across with the list.
• Employees, including former employees whose records you still hold.
• Locums, sessional staff, students and anyone else who worked at the practice.
• Next of kin and emergency contacts recorded on a patient file.
• Referring practitioners, suppliers and business contacts.

Counted that way, a busy solo practice that has been running for a decade can be over 1,000 data subjects without seeing more than a few hundred patients a year. That moves it from Tier 1 at $50 to Tier 2 at $300 plus the $30 application fee. It is far cheaper to count the archive properly before filing than to amend a licence afterwards, and section 7 of SI 155 makes submitting false information to the Authority an offence carrying a fine of up to level 11 or imprisonment of up to seven years.

What the licence buys, and what it does not

The POTRAZ fee buys a licence. It does not produce any of the documentation the same law requires you to hold, and an inspector arriving at a practice with a licence and nothing behind it will find that out in the first ten minutes.

For a healthcare provider the statutory minimum behind the licence is a gap analysis, the Form DP1 application, a processing notification, records of processing, a privacy policy and patient consent wording, a Data Protection Impact Assessment covering health and minors’ data, a breach response procedure, a data subject access request procedure, a physical records security checklist and staff training under CDPG 1 of 2025. That document set is what the Avalon Health service fee covers.

• A compliance consultation at $90, credited in full toward your package when you proceed.
• Compliance packages from $250 as a one-off service fee for a small single-site practice.
• Larger packages for multi-site groups, hospitals and higher record volumes, quoted on the assessment.
• An ongoing Data Protection Officer retainer once the licence is granted, quoted for your organisation.

The retainer is the part practices forget when they budget. Licensing is a single event, but the licence has to be renewed every twelve months, the registers have to stay current, a breach has to be notified inside twenty-four hours and an inspector will ask who your appointed officer is. The engagement options and current retainer arrangements are set out on the main compliance page.

The annual cost after the first year

Section 5(1) of SI 155 of 2024 makes a Data Controller licence valid for twelve months, subject to your continuing compliance with the Act, the regulations and any conditions attached to the licence. So the licence fee recurs, and the application fee does not.

Renewal is not something to leave until the last month. Section 5(2) requires a renewal application, on the same Form DP1 and with the fee, at least three months before the licence expires. Section 5(3) then makes failing without just cause to renew by the expiry date an offence in its own right, carrying the same maximum penalty as never having licensed at all. Filing the renewal is one of the duties covered by the DPO retainer.

What non-compliance costs instead

It is worth setting the fees against the alternative, because the licence fee is small relative to the exposure. Processing personal information without a Data Controller licence is an offence under section 3(3) of SI 155 of 2024, carrying a fine of up to level 11 or imprisonment of up to seven years or both. Failing to appoint a Data Protection Officer is an offence under section 12(6), carrying up to level 7 or two years.

The instruments express fines as a level on the standard scale rather than as an amount of money. The level is fixed in the law, but the value of a level is set by the standard scale and revised from time to time, so we do not publish a dollar figure for a fine and you should be cautious of any site that does. What is fixed, and what matters for a practice weighing this up, is that these are criminal offences carrying prison terms rather than administrative charges, and that section 9 of SI 155 makes the register of licensed controllers public and inspectable.

How Avalon Health quotes a practice

The consultation is a one-hour working session at the practice or on a call. Our certified data protection officers confirm your controller status, map how patient records are held, stored and shared, and count the archive properly so that your tier is a fact rather than an estimate. You then receive a written assessment and an accurate quotation showing the Avalon Health fee and the POTRAZ fees as two separate figures, and the $90 is credited in full toward your package when you proceed.