Every licensed data controller in Zimbabwe needs a Data Protection Officer. From 1 September, POTRAZ inspectors will be checking. The country's data controllers — churches, schools, hospitals, fintechs, retailers, NGOs, any organisation processing personal data of 50 or more people — will be scrambling to fill a role most of them did not know existed twelve months ago. That is the supply problem. The other side of it is the opportunity. For anyone with a degree and two free weeks, becoming a POTRAZ-certified DPO is now a real career move, and the path from application to certificate is shorter and cheaper than the licensing regime it sits inside.
Here is the full path, in order, with the costs and the requirements you should know before you start.
Who qualifies. The Cyber and Data Protection Regulations under S.I. 155 of 2024 require that the appointed DPO possess skills, qualifications, or experience in data science, data analytics, information security, audit, or any other relevant field. In practice, POTRAZ's delivery partner — the Harare Institute of Technology — expects a recognisable degree. Law, accounting, computer science, business, statistics, and risk management all fit the profile. There is no published minimum grade requirement, but candidates without a tertiary qualification will struggle to clear the application stage. If you already work in compliance, IT, audit, HR, or legal, you are a strong fit. If you do not, the certificate itself is the credential — but you will need a degree to get onto the course.
The application. The enrolment process starts at the HIT website. Download the DPO Certification Course application form, complete it, and submit it either physically on the HIT campus or by email to dpotraining@hit.ac.zw. There is a non-refundable US$30 application fee payable to HIT or to POTRAZ. The fee is small, but it is non-refundable — submit only when your application is complete. Once HIT confirms approval, you move to the tuition step.
The course. The DPO certification is a two-week, in-person programme currently delivered at HIT's Harare campus. POTRAZ oversees the curriculum and the certification, HIT provides the venue and academic administration. The tuition is US$1,250 for Zimbabwean applicants, payable once your application is approved. Bring the total committed spend to US$1,280 before you start. Class schedules run periodically — POTRAZ announces intakes on its official channels and HIT promotes the next intake on its events page. Apply early; the cohorts fill up as the 1 September enforcement window approaches.
The exam. At the end of the two weeks, you sit a four-hour examination. If you pass, POTRAZ issues a Data Protection Certificate in your name. The certificate is the artefact. It is what you present to any data controller that wants to appoint you, and it is what POTRAZ records against the data controller's notification of appointment. Without the certificate, no organisation can lawfully designate you as their DPO. With it, you are qualified to act for any number of data controllers in parallel.
What you can do after certification. This is where the career math starts to work. Three doors open. The first is in-house employment: medium and large organisations will hire a full-time DPO once their data controller licence renewal makes the role permanent. The second is consulting: a certified DPO can serve multiple small data controllers as an outsourced officer, which is the practical answer for the tuckshop, the school, the church, and the local clinic that cannot afford a full-time hire but still need someone to hold the role. The third is advisory work — supporting data controllers through their licence application, drafting their privacy notices, building their register of processing activities, and standing up their breach-response procedures. If you can do all three, the certified DPO certification pays for itself within one or two clients.
The practical path. If you are starting from zero, the order of operations is: confirm your degree qualification, watch HIT's events page and POTRAZ's social channels for the next intake, download and submit the application form with the US$30 fee, pay the US$1,250 tuition once approved, complete the two-week course, pass the four-hour exam, and start positioning yourself as a DPO before the 1 September enforcement window forces every data controller in the country to find one. The bottleneck right now is supply. POTRAZ has trained hundreds of DPOs since the certification regime was established, but the country's data controller population runs into the tens of thousands. Demand will outstrip supply for at least the next 18 months.
The cost, the time, the upside. Two weeks of study. US$1,280 in committed fees. A four-hour exam. A certificate that unlocks a regulated, undersupplied profession at the exact moment the regulator begins enforcement. For most candidates, that is one of the sharpest return-on-investment moves in the Zimbabwean professional market today.
Photo by Hennie Stander on Unsplash
