The "tax" nobody put on your invoice
You've made peace with the 2% IMTT that nibbles every US dollar transfer. You've updated your invoices for 15.5% VAT, mostly without crying. Then a client forwards a WhatsApp voice note at 9pm: "Do you guys have your POTRAZ data controller licence?"
If your honest answer is "our what?", you're in good company. The licence became compulsory on 12 March 2025 for anyone processing personal data on 50 or more people. Many organisations still haven't registered.
The grace period is over. POTRAZ began mandatory compliance inspections on 1 September 2026, and its officials told Business Times that audits would intensify in the fourth quarter of 2026. That's now.
This guide answers the question in the title: what a Zimbabwe marketing agency pays in tax in 2026. Then it covers the bill that isn't technically a tax but behaves exactly like one, and what happens if you ignore it. Telecoms companies and any business with a customer list, CRM or staff records should read on too. Want the answer for your own business?
The taxes every Zimbabwe marketing agency already pays
A typical agency pays 25.75% on profit, charges 15.5% VAT on its fees, loses 2% to IMTT on US dollar transfers and runs PAYE on every salary. Here's the 2026 line-up:
Tax | 2026 rate | What it applies to |
|---|---|---|
Corporate income tax | 25% plus a 3% AIDS levy, an effective 25.75% | Your taxable profit (PwC) |
VAT | 15.5%, up from 15% on 1 January 2026 | Your fees, if you're a registered operator (Herald) |
IMTT | 2% on foreign currency transfers; 1.5% on ZiG | Electronic transfers; now deductible for corporate tax if you're fully registered (Herald) |
PAYE | Progressive bands, top rate 40% plus the AIDS levy (41.2% effective) | Staff salaries (Trading Economics) |
One newcomer to watch: the 2026 budget introduced a Digital Services Withholding Tax on payments to offshore digital platforms, replacing VAT on imported digital services (VATCalc). If you pay for overseas software, platforms or ad tools, ask your tax practitioner how it applies to you.
The good news on IMTT: you can now deduct it, but only if you're registered for corporate income tax, plus PAYE and VAT where they apply. Being fully compliant finally pays you back, a little.
The new law: the POTRAZ data controller licence
If you process personal data on 50 or more people, the law requires a POTRAZ data controller licence. It comes from the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024, with POTRAZ acting as the Data Protection Authority.
Personal data is anything that identifies a person: names, phone numbers, ID numbers, addresses, employment records, bank details, health information and biometrics (Herald). Fifty people sounds like a lot until you start counting.
Marketing agencies usually pass 50 before lunch on day one:
- Staff records and payroll
- Client contacts, contracts and invoices
- Leads from website forms, landing pages and ad campaigns
- Email newsletter and WhatsApp broadcast lists
- CRMs and customer lists you manage or upload as ad audiences for clients
Who is responsible for client data you handle depends on your contracts, so put that question to your Data Protection Officer or lawyer.
Telecoms companies hold subscriber records, call data, mobile money details and ID numbers at enormous scale, which puts most of them in the top licence tier.
Everyone else is covered too. The Herald lists schools with pupil records, churches with membership registers, clinics with patient files, supermarkets with loyalty programmes and any company keeping employee records. The exemptions are narrow: purely personal or household use, some law enforcement, and some journalistic, historical and archival work.
And yes, WhatsApp groups count. When the rules arrived, the ICT minister said admins of groups used for business need a licence. The family group planning Sekuru's birthday is safe. The one where you sell to 300 prospects is not.
How much the data controller licence costs
The licence costs US$50 to US$2,500 a year, depending on how many people's data you process. Add a certified Data Protection Officer and a small agency's first-year bill lands around US$1,610.
Tier | People whose data you process | Annual licence fee | Application fee | First-year total with an in-house certified DPO |
|---|---|---|---|---|
1 | 50 to 1,000 | US$50 | None | US$1,330 |
2 | 1,001 to 100,000 | US$300 | US$30 | US$1,610 |
3 | 100,001 to 500,000 | US$500 | US$30 | US$1,810 |
4 | More than 500,000 | US$2,500 | US$30 | US$3,810 |
Fees from The Herald and CITE. The first-year total adds DPO certification at US$1,250 plus a US$30 application fee, as reported by CITE.
Most marketing agencies land in Tier 2: a few years of leads, newsletter sign-ups and client contacts pass 1,000 quickly. Large telecoms companies sit in Tier 4.
The licence lasts 12 months and must be renewed every year. So yes, it behaves like a tax: annual, compulsory and owed whether or not you had a good year. The DPO certification is the bigger cheque, which is why some businesses share an external consultant as their DPO instead of training their own.
The fines: the cheap part and the expensive part
Processing personal data without a licence can bring a Level 11 fine, up to seven years in prison, or both. The same penalties apply if you fail to protect the data properly (Herald).
Here's the twist. Under the standard scale of fines ZIMRA published for 2023 (S.I. 14A of 2023), Level 11 is US$1,000, payable in local currency. The scale gets revised from time to time, so check the current figure. Either way, the fine is the cheap part. The seven years is the expensive part, and CITE reports it lands on the chief executive.
What else can go wrong:
- A data breach you don't report in time. You must tell POTRAZ within 24 hours and the people affected within 72 hours.
- Other breaches of the Act. CEOs and accountable officers face fines up to Level 7 or up to seven years in prison (Business Times).
- An inspection you're not ready for. POTRAZ can audit, investigate, issue warnings and directives, and start criminal proceedings.
Inspections follow a risk-based order: financial institutions, insurers, local authorities and healthcare providers first, then mining companies, religious organisations, schools, professional bodies, government and NGOs. Being further down the list buys you time, not immunity.
Not sure where you stand? We'll check how your business collects and stores personal data and show you what to fix before an inspector asks.
How to get compliant, step by step
Start the DPO step early, because it involves a certification course and costs the most. Here's the order that saves the most headaches:
- Count your people. Add up staff, clients, leads, newsletter and WhatsApp lists, CRM records and client data you handle. That number sets your tier.
- Apply for your licence. Use Form DP1 on the POTRAZ website and pay the fee for your tier (MISA Zimbabwe).
- Appoint a Data Protection Officer. Train someone through an approved certification programme or hire an external DPO, then notify POTRAZ of the appointment.
- Map your data. List what you collect, why, where it's stored and who can see it. Delete what you don't need; data you never kept can't leak.
- Fix your front door. Your website forms, landing pages and chat widgets collect most of your personal data. Tell people what you collect and why, ask for consent where it's needed, and make sure the site runs on HTTPS.
- Write a breach plan. Decide who calls POTRAZ within 24 hours and who contacts affected people within 72 hours, before you ever need it.
- Diarise your renewal. The licence runs for 12 months, and MISA Zimbabwe advises renewing three months before it expires.
- Keep the tax side tidy too. Check your invoices show 15.5% VAT, and stay fully registered so you can claim the IMTT deduction.
Quick self-check: are you inspection-ready?
Every "no" or "not sure" below is something an inspector could ask about. Tick what you can answer with confidence:
- We know roughly how many people's personal data we hold
- We have a current POTRAZ data controller licence for the right tier
- We have appointed a certified Data Protection Officer and told POTRAZ
- Our website forms say what data we collect and why
- Only the staff who need customer data can access it
- We know who reports a breach to POTRAZ within 24 hours
- Our licence renewal date is in the calendar
- Our invoices charge 15.5% VAT and we're registered to deduct IMTT
Three or more gaps? Don't panic, but don't wait for a knock on the door either.
Book your free audit before POTRAZ books you
A free audit shows exactly where your business collects personal data, which licence tier you likely fall into and what to fix first. It turns "we should really look into this" into a short, prioritised to-do list.
Here's what we check:
Area | What we look at |
|---|---|
Data collection | Website forms, landing pages, chat widgets, newsletter and WhatsApp sign-ups |
Your tier | A rough count of the people whose data you hold, and the licence tier that matches |
Website basics | Privacy notice, consent wording on forms, HTTPS security |
Access and storage | Where customer data lives and who can reach it |
Readiness | Licence, DPO appointment and breach plan status |
You get a plain-English summary with your top priorities. There's no cost and no obligation, and the report is yours to keep.
Inspections started on 1 September. Find out where you stand this week.
Frequently asked questions
How much tax does a marketing agency pay in Zimbabwe?
In 2026, an agency pays corporate income tax at an effective 25.75% on profit and charges 15.5% VAT on fees if registered. It also pays 2% IMTT on US dollar transfers and runs PAYE on salaries. On top of that sits the annual POTRAZ data controller licence, from US$50 to US$2,500.
Is the POTRAZ data controller licence a tax?
Not legally; it's a licence fee under Statutory Instrument 155 of 2024. In practice it behaves like one: it's compulsory, renewed every year and owed regardless of profit.Who needs a data controller licence in Zimbabwe?
Any organisation that processes personal data on 50 or more people, with narrow exemptions for personal, household, some law enforcement, journalistic, historical and archival use. That covers agencies, telecoms companies, schools, clinics, churches and most businesses with staff or customer records.
What is the fine for not having a data controller licence?
Processing personal data without a licence can bring a Level 11 fine, up to seven years in prison, or both. Level 11 was US$1,000 under the 2023 standard scale of fines, payable in local currency.
Do WhatsApp group admins need a POTRAZ licence?
The ICT minister said in 2024 that admins of WhatsApp groups used for business need one. Personal and family groups are not the target.
When did POTRAZ start data protection inspections?
Mandatory compliance inspections began on 1 September 2026 under Regulatory Notice 2 of 2026, starting with high-risk sectors such as banks, insurers, local authorities and healthcare providers.
Do I need a Data Protection Officer?
Yes. Every data controller must appoint a certified DPO and notify POTRAZ. Certification was reported at US$1,250 plus a US$30 application fee, so many small businesses use an external DPO instead.
The bottom line
A Zimbabwe marketing agency pays 25.75% on profit, charges 15.5% VAT, loses 2% to IMTT and runs PAYE. Since March 2025, it has also needed a POTRAZ data controller licence and a certified DPO. ZIMRA you knew about. POTRAZ is the one now knocking.
The good news is that compliance costs far less than the alternative. Find out your tier, get licensed, appoint your DPO and tidy up how your website collects data.
Not sure where to start? Let us do the looking for you.
This post is general information, not legal or tax advice. Rates, fees and fines were checked on 12 October 2026 and can change, so confirm with POTRAZ, ZIMRA or a registered tax practitioner before acting.
Sources
- The Herald, "EXPLAINER: From creches to clinics, what Potraz's data inspections mean for everyone" (29 July 2026)
- CITE, "POTRAZ data licence fees slammed as costly burden on businesses and consumers" (30 July 2026)
- Business Times, "POTRAZ plots crackdown on firms"
- MISA Zimbabwe, "Navigating the Data Protection Act Requirements" (14 March 2025)
- Independent on Saturday, WhatsApp group admins and licence fees (11 November 2024)
- PwC Tax Summaries, Zimbabwe corporate income tax
- The Herald, "IMTT cut to 1,5pc, as VAT inches up 0,5pc"
- VATCalc, Zimbabwe raises VAT to 15.5% in 2026
- Trading Economics, Zimbabwe tax rates
- ZIMRA, "Offences and Standard Scale of Fines" (S.I. 14A of 2023)