In 2022, Zimbabwe enacted the Cyber and Data Protection (Licensing of Data Controllers and Appointment of DPOs) Regulations under the Cyber and Data Protection Act [Cap. 12:07]. These regulations, issued by the Minister of Information and Communications Technologies (ICT), mandate that any individual, organization, or entity handling personal data must obtain a data protection license. This law initially covered larger corporations, public authorities, and agencies that collect, process, or store personal data.
Expansion of Data Protection Licensing to WhatsApp Group Admins
In a significant update announced by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) on November 6, 2024, WhatsApp group administrators managing groups with commercial intent or those who collect personal data are now required to obtain a data protection license. During a recent awareness session, Hon. Tatenda Mavetera, the Minister of ICT, Postal, and Courier Services, emphasized that this requirement applies to entities that monetize or otherwise benefit financially from the personal information they collect. This includes not only businesses but also non-profit organizations, such as churches, if they handle personal data.
However, purely social groups, such as family gatherings or informal friend groups, are exempt from the licensing requirement, as they do not collect or process data for commercial gain.
Licensing Tiers and Fees Based on Group Size
The 2024 update introduces a tiered licensing fee structure based on the number of data subjects or group members, impacting administrators who gather data for commercial purposes:
Tier 1: Groups with 50 – 1,000 members – $50
Tier 2: Groups with 1,001 – 100,000 members – $300
Tier 3: Groups with 100,001 – 500,000 members – $500
Tier 4: Groups with over 500,000 members – $2,500
WhatsApp group administrators and business owners who aim to monetize member data are also required to appoint a certified Data Protection Officer (DPO). This DPO, registered with POTRAZ, will oversee the management of personal data to ensure compliance with the Cyber and Data Protection Act and mitigate potential data breaches.
Regulatory Compliance and Implementation Challenges
Under the existing law, entities required to obtain a data protection license must conduct a self-assessment, complete Form DP1 as specified in the First Schedule of the 2022 regulations, and submit an annual application using Form DP2. The self-assessment tool is available on the Authority’s website to facilitate the licensing eligibility process. Licensed data controllers are also required to renew their license annually and pay a specified application or renewal fee.
The recent announcement has sparked widespread public debate. Many individuals are concerned about how these regulations will be enforced on a platform as ubiquitous and informal as WhatsApp. Small business owners and group admins have expressed concerns about the potential financial burden and the complexity of adhering to these new requirements, especially given the popularity of WhatsApp as an informal business platform in Zimbabwe. Social media has been filled with questions regarding how POTRAZ plans to monitor compliance and enforce licensing requirements across the extensive and varied landscape of WhatsApp groups.
Public Reactions and Government Response
Public response to the regulation has been mixed. While some see it as a step toward greater data security and accountability, others worry about the potential impact on small and micro-enterprises that rely on WhatsApp as a primary means of communication and business. Critics argue that these regulations could stifle entrepreneurship and place an undue burden on small business operators who are already navigating economic challenges.
In response, Minister Mavetera and POTRAZ have encouraged affected parties to reach out for guidance on compliance with the new requirements. They maintain that these measures aim to strengthen data privacy and protection in line with global standards, despite concerns regarding enforcement and practical implementation. However, skepticism remains, with questions about whether these new requirements will be beneficial or merely add another bureaucratic layer for Zimbabwean entrepreneurs.
