Zimbabwe healthcare data protection

POTRAZ Data Controller Licence for Doctors and Private Practices in Zimbabwe

A Zimbabwean doctor in private practice must hold a POTRAZ Data Controller licence to keep patient records lawfully. Most doctors’ rooms hold under 1,000 records, which places them in Tier 1: a $50 licence fee, exclusive of VAT, with no application fee at Tier 1. A Data Protection Impact Assessment and a designated Data Protection Officer are still mandatory, because health data is sensitive data.

Written by the Avalon Health data protection team. Last reviewed 28 August 2026.

Does a private practice really need a POTRAZ licence?

Yes. Under the Cyber and Data Protection Act [Chapter 12:07] and SI 155 of 2024, any organisation that decides why and how personal data is processed is a data controller, and every data controller holding personal data must be licensed by POTRAZ. A doctor in private practice decides what goes into a patient file, how long it is kept and who may see it, so the practice is a data controller. The size of the practice changes the fee tier, not the obligation.

This applies whether records are on paper or in an electronic system. A practice running entirely on manual patient cards and a filing cabinet is in exactly the same position as one running a full electronic medical records system. Operating as an unlicensed data controller is an offence under the Act.

Which tier is a doctors’ practice in?

Your tier is set by the total number of individuals whose personal data you hold, not by your annual turnover and not by how many patients you saw last month. The count is cumulative and it includes everyone: current patients, historical patients whose files you still hold, employees, locums and business contacts. Practices routinely underestimate this, because dormant files from previous years still count while they remain in the archive.

Most solo practitioners and small doctors’ rooms fall inside Tier 1. A practice that has been running for many years, or one that has absorbed another practice’s patient list, can cross into Tier 2 without realising it. Counting the archive properly before filing is the difference between a correct licence and an amended one.

What a Tier 1 practice actually pays

There are two separate numbers and we never merge them into one total. The first is what you pay POTRAZ. The second is what you pay for the work of getting you licensed and documented.

• POTRAZ Data Controller licence at Tier 1: $50, exclusive of VAT, paid to POTRAZ at cost.
• POTRAZ application fee: not applicable at Tier 1. It applies from Tier 2 upward, and it is not charged on renewals at any tier.
• Compliance packages from $250 as a one-off service fee, covering the filing and the full document set.
• A compliance consultation at $90, credited in full toward your package when you proceed.

POTRAZ figures are quoted exclusive of VAT because POTRAZ adds VAT on its own invoice at a rate we do not set. You pay POTRAZ exactly what POTRAZ bills. The licence renews annually at the tier fee, with no application fee on renewal.

Why a DPIA is mandatory even at Tier 1

A Data Protection Impact Assessment is an assessment of the risk your processing creates for the people whose data you hold, and of what you have done to reduce it. Many small organisations assume a DPIA is only for large processors. For a medical practice that assumption is wrong, because the trigger is the nature of the data, not the volume.

Health data is sensitive personal data under the Act. So is data about children, and a practice that treats minors holds both categories at once. Processing sensitive data is high-risk processing by definition, which means a DPIA is required regardless of how few records the practice holds. A single-doctor practice with 400 patient files still needs one.

In practice a DPIA for doctors’ rooms covers what categories of health data you record, the lawful basis and consent you rely on, who inside and outside the practice can see a file, how records move between the consulting room and any laboratory or specialist, how long you keep files after a patient stops attending, and what would happen if the archive were lost or stolen. It is a working document, not a formality, and inspectors read it.

Why a designated DPO is required even at Tier 1

Under SI 155 of 2024 a Data Protection Officer is a condition of holding a Data Controller licence. For a healthcare provider the requirement is firm rather than discretionary, because the practice processes sensitive data: health data, and in most practices children’s data as well. You cannot hold the licence without naming a DPO, so the only real decision is how the role is provided.

A small practice has two routes. It can designate someone internally, who must be competent in data protection law and free of any conflict of interest with their other duties, which rules out the person who also runs the practice commercially. Or it can appoint an external DPO on record, which is how most doctors’ rooms handle it, since a solo practice rarely has a spare person with the training. Avalon Health can act as your DPO on record. The engagement options are set out on the main compliance page.

The document set a solo practice needs

Being licensed and being inspection-ready are not the same thing. The licence is one filing. What an inspector then asks to see is the evidence behind it. For a Tier 1 healthcare practice the statutory minimum is:

• A gap analysis against the Cyber and Data Protection Act, so you know what is missing before an inspector does.
• The POTRAZ Data Controller licence application, Form DP1, prepared and filed.
• A POTRAZ processing notification describing your processing activities.
• Records of Processing, the ROPA, documenting what patient data you hold, why, and for how long.
• A privacy policy and patient consent wording that patients can actually be shown.
• A Data Protection Impact Assessment covering health and minors’ data.
• A written data breach response procedure.
• A data subject access request procedure, for when a patient asks for their own file.
• A physical records security checklist, because paper files are in scope.
• Staff data protection training under CDPG 1 of 2025, with the training record retained.

Training is a requirement, not an extra

CDPG 1 of 2025, the POTRAZ assessment guidelines, makes training mandatory for staff who handle personal data. In a practice that means the receptionist who takes patient details at the front desk and the nurse who pulls files, not only the doctor. Inspectors ask for the training record, so an undocumented briefing does not count. Avalon Health runs sessions outside consulting hours so the practice does not lose clinic time.

How Avalon Health gets a practice licensed

The engagement starts with a one-hour compliance consultation at $90, at the practice or on a call. Our certified data protection officers confirm your controller status, map how patient records are held, stored and shared, and confirm your exact POTRAZ tier by counting the archive properly. You then receive an assessment and an accurate quotation, and the $90 is credited in full toward your package when you proceed.

From there the work is ours. We prepare and file the licence application, build the document set above, run the staff training session and hand you the training record. Most solo practices are documented and filed within one to two weeks.