Security Solution Consultants (SSC) are cyber security consultants for Harare organisations that need to meet Zimbabwe’s Cyber and Data Protection Act, POTRAZ licensing and inspections, Reserve Bank of Zimbabwe cyber security expectations, ISO 27001, PCI DSS and ISO 45001. We work with banks, insurers, mobile money and fintech providers, mining companies, healthcare providers and local authorities, combining practical GRC consulting with GRCLens, our own GRC platform.
| Obligation | Who it applies to | What it asks for |
|---|---|---|
| Cyber and Data Protection Act [Chapter 12:07] | Data controllers and processors | Lawful processing, special rules for sensitive, health, genetic and biometric data, security safeguards, and breach notice to POTRAZ within 24 hours |
| SI 155 of 2024 (licensing and data protection officers) | Data controllers, with licence fees from US$50 to US$2,500 by tier | A POTRAZ licence renewed every 12 months, a certified data protection officer, and notice to affected people within 72 hours of a breach |
| POTRAZ Regulatory Notice 2 of 2026 | Financial institutions, insurers, local authorities, healthcare, mining and schools first | Risk based compliance inspections from 1 September 2026 |
| Reserve Bank of Zimbabwe cyber security guidance | Banks and payment system providers | Board oversight, a CISO, third party risk management, periodic audits and incident reporting |
| Mines and Minerals Act, mining safety regulations and ISO 45001 | Mining companies and contractors | Mine safety duties; ISO 45001 is held by major operators such as Zimplats and Mimosa |
| PCI DSS v4.0.1 | Banks, switches, merchants and payment providers handling card data | Twelve requirement areas, with the future-dated requirements mandatory since 31 March 2025 |
A POTRAZ inspection will ask whether you are licensed, who your data protection officer is and whether they are certified, what personal data you hold and why, how it is secured, and how you handle breaches and data subject requests. Health, genetic and biometric data carry extra conditions, and transfers outside Zimbabwe need a lawful basis.
We confirm your licence tier, support the data protection officer, build the records, policies and breach procedures, and run a mock inspection so the real one holds no surprises.
Zimbabwe exported 1.128 million tonnes of lithium concentrate in 2025, and new processing plants are being built ahead of a ban on concentrate exports from 2027. Platinum producers such as Zimplats and Mimosa already hold ISO 45001, and POTRAZ has named mining companies among the first sectors to be inspected. The July 2024 cyber attack on Sibanye-Stillwater, a co-owner of Mimosa, showed how incidents at a parent group reach local operations.
We help mines build ISO 45001 safety management systems, secure processing plants and remote access with IEC 62443, and meet their data protection duties for employee and contractor data. See our ISO 45001 consulting and operational technology security assessments.
The Reserve Bank of Zimbabwe expects banks and payment system providers to run board overseen cyber security programmes with a CISO, third party risk management, periodic audits and incident reporting, and the Governor has warned about weaknesses in third party providers and digital banking. Zimswitch has achieved PCI DSS compliance and EcoCash Holdings became the first Zimbabwean fintech certified to ISO 27001, which raises expectations for everyone connected to them.
We run gap assessments against RBZ expectations, PCI DSS scoping and readiness, and incident response planning. See our PCI DSS compliance advisory and cyber security maturity assessments.
Consulting gets you compliant. GRCLens, the governance, risk and compliance platform we built and use on every engagement, keeps you compliant. It orchestrates your regulatory and legislative compliance in one place, so your risk, compliance and audit teams work from the same controls, evidence and numbers.
See GRCLens for Zimbabwe, or request a GRCLens demo.
We also support organisations in Johannesburg, Cape Town, Nairobi and Lusaka.
Data controllers that process personal data in Zimbabwe need a licence under SI 155 of 2024, with the fee tier set by the number of data subjects. Licences last 12 months and should be renewed three months before expiry.
GRCLens is the governance, risk and compliance platform we built and use on every engagement. It holds your obligations, controls, evidence, risks and board reporting in one place. Many clients keep using it after the project to run their compliance programme, but our consulting does not depend on it.
Data controllers must appoint a data protection officer and notify POTRAZ within 90 days, and the officer must complete a certification course approved by POTRAZ.
Under SI 155 of 2024, breaches are reported to POTRAZ within 24 hours and to affected data subjects within 72 hours.
Expect questions about your licence, your data protection officer, what personal data you hold and why, how it is secured, how you handle breaches and requests, and any transfers outside Zimbabwe.
We deliver most work remotely and use a local partner firm for on-site interviews, mock inspections and audits in Harare and at mine sites.
Tell us where you are today and what you need to achieve. We will come back with a clear scope, timeline and fixed quote.
Secure your cloud environments & ensure safe migration with compliance-ready.
Stay informed with the latest cybersecurity news and expert tips.
Copyright © 2026 Security Solution Consultants. ABN 87 616 212 063. Tarneit, Victoria 3029, Australia. All Rights Reserved.
