A WhatsApp bot’s first message is usually “Hi! What’s your name and what do you need?”. From that moment the business is collecting personal data by automated means, at scale, and storing it somewhere. In Zimbabwe that activity is regulated, licensed and, since March 2025, enforceable with fines and imprisonment. This guide is not legal advice; it is the checklist we run at scoping so the flow is designed for the law rather than retrofitted to it.
The law in five lines
- The Cyber and Data Protection Act [Chapter 12:07] sets the framework for processing personal data. Section 5 designates POTRAZ as the Data Protection Authority (MISA, IFEX).
- The Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, SI 155 of 2024, promulgated September 2024, require entities that process personal data for commercial purposes to hold a data controller licence (MISA).
- Licences are tiered. IFEX reports the tiers as USD 50 (Tier 1), USD 300 (Tier 2), USD 500 (Tier 3) and USD 2,500 (Tier 4); MISA gives a range of USD 50 to USD 2,000. The tier depends on the organisation’s size and the scope of processing. A licence is valid for 12 months and renewal must be applied for three months before expiry (MISA).
- Every licensed controller must appoint a data protection officer (DPO), with qualifications in law, data science, information systems audit or a relevant field, and complete certification through the Harare Institute of Technology (MISA).
- Deadline and penalty. The deadline for obtaining a licence was 12 March 2025. A controller that continues processing without one is liable to a fine not exceeding level 11 (USD 1,000) or imprisonment not exceeding seven years, or both (MISA).
MISA also notes the working threshold used in guidance: entities managing personal data of 50 or more individuals, including names, addresses, IDs, phone numbers, IP addresses and online identifiers. Personal, household, journalistic and archival processing are exempt.
For a sense of enforcement attention: in November 2024 the ICT minister stated that administrators of WhatsApp groups would need to register and obtain a POTRAZ licence (AllAfrica). Whatever one thinks of that policy, it signals that WhatsApp activity is squarely in the regulator’s field of view.
Does a bot make you a data controller?
If you were not one before, the bot does not change your legal status; it changes your scale. A shop owner replying by hand to thirty customers a week is processing personal data too. A bot logging every conversation to a CRM with a normalised +263 number, a name, a suburb and a purchase intent will pass 50 individuals in a day. The licence question becomes unavoidable, and the answers to “what do we collect, why, where is it stored, for how long, who can see it” have to exist in writing because the bot’s configuration is those answers.
The checklist, mapped to bot design
Each row is an obligation or good-practice item we hear from the sources above, and the concrete thing we build so the flow satisfies it.
| Obligation / practice | Where it lives in the bot |
|---|---|
| Lawful basis and purpose | The first message states who is collecting data and why (“to answer your enquiry and, if you agree, send you order updates”). The purpose text is stored with the consent flag. |
| Consent, freely given | An explicit yes before any data beyond the enquiry itself is stored; marketing is a separate opt-in, never bundled with “reply to continue”. Meta’s own rules require opt-in for marketing templates anyway. |
| Right to withdraw / opt out | A STOP (or “unsubscribe”) keyword that works at every point in every flow, removes the marketing flag immediately, and confirms in one line. |
| Access and correction | A “what do you have on me?” request routes to the DPO with the customer’s record attached; corrections are made in the system of record, not in a side note. |
| Data minimisation | The flow asks only for fields the process needs. A booking needs a name and a number; it does not need an ID number unless your practice software does. |
| Retention | Conversation logs and CRM records carry a retention period set at scoping (e.g. 24 months after last contact), enforced by an automated purge, not by intention. |
| Security | Credentials in an encrypted secret store; staff access to the inbox by role; audit log of who read what. |
| Processors and cross-border transfer | Meta processes WhatsApp messages; your hosting and model providers may be outside Zimbabwe. The Act regulates transfers; we document where each processor stores data so your DPO can assess it. |
| DPO contact | The DPO’s name and contact appear in the privacy notice the bot links or quotes, and the bot can hand a data-rights request straight to them. |
| Licence status | Asked at scoping; the scoping document records the tier and expiry date so the annual renewal becomes a workflow reminder, not a surprise. |
What “consent in the first message” looks like
Short, plain, and not buried:
Hi, you’re chatting with [Business]. To answer you we’ll keep your number and this conversation. Reply STOP any time to be removed. Would you also like order updates and occasional offers? Reply YES to opt in.
Two flags are stored: service consent (implied by continuing; required to answer at all) and marketing consent (explicit YES). The bot only ever sends a marketing template to a number with the second flag. The monthly report shows how many people opted in and how many stopped, which is also a health metric for your messaging.
Three mistakes we see
- Treating a Meta business verification as compliance. Meta verifies that you are a real business; POTRAZ licenses you to process data. Different things.
- Keeping everything forever “in case”. Retention without a purge is a liability that grows every day. Set a period and let the system enforce it.
- Letting the bot handle a rights request. A customer who asks “delete my data” is exercising a legal right. The bot should acknowledge and route to the DPO, not attempt to answer.
Before you brief us
Have three things ready: your licence tier and expiry date (or the intention to apply), the name of your DPO (or who will be), and your retention period. If you do not have them, the first call is where we work them out, and the scoping document records them. The scoping worksheet asks the licence question so it is not forgotten.