The short answer
You can host personal data outside Zimbabwe, but the Act expects the destination to offer an adequate level of protection, and organisations must notify POTRAZ of an intention to transfer data outside the country. If you process personal data of 50 or more people, you also need a data controller licence and a Data Protection Officer. POTRAZ began mandatory compliance inspections on 1 September 2026.
What the law says
| Instrument | What it does |
|---|---|
| Cyber and Data Protection Act [Chapter 12:07] | Gazetted on 3 December 2021. Section 5 makes POTRAZ the Data Protection Authority. |
| Section 28 | A data controller may not transfer personal information to a third party in a foreign country unless an adequate level of protection is ensured. Section 28(2) lists what to consider when judging adequacy. |
| Section 29 | Sets out the cases in which a transfer to a country without adequate protection may still take place. |
| Statutory Instrument 155 of 2024 | Requires entities processing personal data to hold a data controller licence (deadline 12 March 2025) and appoint a Data Protection Officer. Licences last 12 months, with renewal applications due three months before expiry. |
| Regulatory Notice 2 of 2026 | Announced mandatory compliance inspections and assessments of data controllers from 1 September 2026. |
Processing personal information without a valid data controller licence can attract a Level 11 fine, imprisonment of up to seven years, or both, according to reporting on the regulations.
Why this matters for cloud systems
A cloud region is a physical place. A system hosted in an AWS region in the United States or Europe stores its data in that country. In assessments we have carried out, the most common finding is personal, health or payroll data hosted offshore without a documented transfer mechanism or notice to POTRAZ.
The closest AWS region to Zimbabwe is Cape Town (af-south-1). Moving there does not remove your obligations, because South Africa is still outside Zimbabwe, but it changes the adequacy question and usually improves latency. It also tends to cost more than the largest US regions, so the decision needs both a legal and a cost view.
An engineering checklist
These are the technical controls your DPO and lawyers will want evidence of. They come from real assessments of AWS estates.
- Inventory. List every system, the personal data it holds, the AWS region it runs in and who can access it.
- Region decision. Record why each system sits where it does. Where data leaves Zimbabwe, give your DPO what they need for the POTRAZ notice.
- Identity. Enforce MFA, remove shared administrator keys, set a password policy and review who has access.
- Edge protection. Put a web application firewall in front of every internet-facing load balancer and CDN distribution, with logging on.
- Encryption. Encrypt data at rest with managed keys and in transit with TLS.
- Backups you can restore. Copy backups of databases holding personal data to a second region, and test a restore.
- Secrets. Keep credentials out of code and local variable files; use a secrets manager.
- Breach readiness. Write and rehearse a breach-response process with named owners and timelines. Commentators summarising the framework cite a short notification window to POTRAZ; confirm the current requirement with your adviser.
- Documents. Keep a compliance verification report, a risk assessment, a data protection impact assessment and a disaster recovery runbook up to date.
Who does what
The Data Protection Officer is a legal appointment inside your organisation. Engineers do not replace the DPO; they produce the technical evidence and close the technical gaps so the DPO can make the filings and answer an inspector with confidence.
This guide is general information from an engineering perspective, not legal or financial advice.
