Be ready when POTRAZ asks how your systems protect personal data.
POTRAZ began mandatory inspections of data controllers on 1 September 2026. We assess your systems against the Cyber and Data Protection Act, write the evidence documents and fix the technical gaps, working alongside your Data Protection Officer and lawyers.
What this solves
You do not know where personal data is stored
Many systems sit in overseas cloud regions. The Act expects adequate protection and notice to POTRAZ before personal data leaves the country.
Access has grown without control
Shared admin keys, missing MFA and leftover accounts are common findings.
Internal tools face the internet
Registries, dashboards and admin panels belong behind VPN-only access.
Nobody has tested a restore
We write and test the disaster recovery runbook.
What you get
- Compliance verification report mapped to the Act
- Cloud environment risk assessment with ranked findings
- Data protection impact assessment for key systems
- Disaster recovery runbook, tested
- IAM and single sign-on audit, MFA enforcement, access clean-up
- WAF, VPN-only access to internal tools and security-finding dashboards
Ways to work with us
- CDPA readiness assessment
- Remediation of agreed findings
- Identity and access audit
- Disaster recovery design and restore test
- Security monitoring dashboard
How the work runs
Discover
Systems, data types, regions and access are mapped.
Assess
Findings are written against the Act and ranked by risk.
Remediate
Technical gaps are fixed in code, highest risk first.
Evidence
Updated documents show what was found and what was fixed.
What changed when we did this work
AWS WAF on every public load balancer and CloudFront distribution, with logging, after a CDPA assessment.
Compliance verification report, cloud risk assessment, DPIA and disaster recovery runbook for an estate holding personal, health and payroll data.
Each finding from an independent security assessment given an owner and a close date, alongside an MFA rollout across platforms.
WAF logs reviewed before each rule is enforced, so real users on regional and satellite networks are not locked out.
Tools we work with
- AWS IAM
- AWS Organizations
- Amazon Cognito
- AWS WAF
- AWS Backup
- AWS KMS
- GuardDuty
- Security Hub
- Trivy
- Client VPN
- site-to-site VPN
- Cloudflare
- Vaultwarden
Do we need a POTRAZ data controller licence?
Under Statutory Instrument 155 of 2024, organisations processing personal data of 50 or more people are required to hold a data controller licence and appoint a Data Protection Officer. Confirm your position with your legal adviser.
Can we keep using a cloud region outside Zimbabwe?
The Act allows transfers where the destination offers adequate protection, and organisations must notify POTRAZ. We document where your data is and what protects it so your DPO can file.
Do you replace our Data Protection Officer?
No. The DPO is a legal appointment inside your organisation. We provide the technical evidence and fix the technical gaps.
Do you hold security certifications?
Yes. Our engineers hold the ISC2 Certified in Cybersecurity credential.
Tell us what you are running today.
Send a short note about your systems and what is getting in the way. You will hear back from the engineer who would do the work.