Services · 06
Data Protection Officer Services
Protect personal data in a way you can prove, not only promise.
Zimbabwe's Cyber and Data Protection Act has applied since 2021. The deadlines to be licensed as a data controller and to appoint a Data Protection Officer have passed, and POTRAZ has moved from awareness to inspection.
Berachah Global provides DPO services through a POTRAZ-certified Data Protection Officer. Our fractional DPO service gives you that expertise on an agreed part-time scope, with the support to get licensed, meet your obligations and stand up to inspection.
Why it matters now
Why data protection is now a board matter
POTRAZ has begun risk-based compliance inspections, starting with banks and financial institutions, insurers, local authorities and healthcare providers. Most gaps are not technical; they sit in everyday records and habits.
Inspections have started.
Routine and unannounced inspections test whether an organisation can evidence compliance, not just describe it.
The scope is wider than expected.
Processing the personal data of 50 or more people generally requires a licence. Customers, members, learners and staff all count.
It is not only an IT issue.
HR files, CCTV, paper registers and WhatsApp groups are all in scope.
Trust is on the line.
Breaches must be reported to POTRAZ promptly, and lost client confidence often costs more than any fine.
What we do
From licensing to inspection
Each service can stand alone, from a one-off readiness review to an ongoing fractional DPO service. The practice works alongside our AI & Digital Transformation pillar.
01
Fractional DPO
A POTRAZ-certified Data Protection Officer on an agreed part-time scope, notified to POTRAZ on Form DP2.
02
Readiness assessment
A gap review against the Act, SI 155 and POTRAZ guidance, with prioritised actions.
03
Licensing
Confirming your tier, preparing Form DP1 and keeping renewals on time.
04
Data mapping
What personal data you hold, why, where and for how long, including data held outside Zimbabwe.
05
Policies and contracts
Privacy notices, consent, retention, breach response plans and data protection agreements with suppliers.
06
Impact and transfer assessments
Impact assessments for high-risk processing, and assessments for data leaving Zimbabwe.
07
Training and inspection readiness
Staff awareness with records, mock inspections and breach response support.
Fractional DPO
How a fractional DPO works
A fractional DPO is an external, certified Data Protection Officer who fills the role for your organisation part-time, on an agreed scope. It suits organisations that must appoint a DPO but do not need a full-time one.
01
Scope
We agree the time, responsibilities and reporting line that fit your size and risk.
02
Appoint and notify
Our POTRAZ-certified DPO is appointed as your DPO and notified to POTRAZ on Form DP2.
03
Run the programme
Compliance monitoring, staff training, internal audits and advice on impact assessments.
04
Be the contact point
We handle POTRAZ requests and enquiries from the people whose data you hold.
05
Report and review
Regular reporting to management and the board, with the scope adjusted as your needs change.
Your organisation always remains responsible for compliance.
The benefits
Why choose a fractional DPO
Certified from day one.
No wait while an internal hire trains and gains POTRAZ certification.
Cost in proportion.
You pay for the time your organisation needs, not a full-time salary.
Continuity when staff move on.
The role does not lapse when someone leaves, so you avoid the rush to appoint a replacement within the 90 days the regulations allow.
An independent view.
The law expects a DPO to act independently, and an external DPO brings that from the start.
Laws and regulators
Grounded in Zimbabwe's law
The requirements we work to, so you can check them yourself.
Cyber and Data Protection Act [Chapter 12:07]
Sets out the data protection principles, people's rights and offences, and names POTRAZ as the Data Protection Authority.
SI 155 of 2024
Regulations on licensing data controllers, appointing DPOs, security and breach reporting.
POTRAZ implementation guidelines
Guidance on compliance assessments, DPO certification, cross-border transfers and smaller enterprises.
Download our data protection awareness booklet (PDF)
This page is for general awareness and is not legal advice. Laws, regulations, fees and forms change; verify the current position with POTRAZ and take advice for your circumstances.
Best for
When to engage Data Protection Officer Services
- Appointing a DPO without a full-time hire
- Getting licensed and preparing for a POTRAZ inspection
- Moving personal data to the cloud or out of Zimbabwe
- Preparing for, or responding to, a data breach
Our method
How an engagement runs
Stage 1 of 5
Listen
Structured conversations with the board, executives and the people closest to the work, to understand the ambition and the constraints.
You leave with: A shared statement of the problem, agreed by sponsors.
What holds throughout
- Values-led advice, practical outcomes
- Independent advice, with partnerships disclosed
- Governance designed before tools are chosen
- Clients own every framework we build with them
Talk to us about your data protection priorities
Tell us where you are and what you need to decide. We'll respond within two working days.