What clients usually ask before their first engagement.
If your organisation collects, stores or processes personal data belonging to Zimbabwean residents — employee records, customer data, CCTV footage — you're likely a data controller or processor under the Act, regardless of size or sector.
An outsourced Data Protection Officer who oversees your compliance programme: maintaining your data inventory, handling data subject requests, coordinating breach response, and reporting to your senior management — without the overhead of a full-time internal hire.
Usually yes. Data protection compliance is a distinct discipline from IT operations — it covers legal basis, governance and regulatory reporting as much as technical controls. We often work alongside internal IT teams rather than replacing them.
A standard discovery assessment, starting from the completed questionnaire, typically takes 2–3 weeks depending on the size of your data estate and how quickly documentation is made available.
Yes. We build or mature your Information Security Management System, run internal audits, and prepare your documentation and staff ahead of a certification body's external audit.
Always. Every VAPT engagement is governed by a signed rules-of-engagement document defining scope, timing and authorisation before any testing begins.
Yes. All information shared with us — including the discovery questionnaire — is treated as private and confidential, governed by an NDA where required.
Reach out via the Contact page or WhatsApp, and we'll send you our DPO discovery questionnaire. From there, we scope a proposal based on what it reveals.
We're happy to talk it through before you commit to anything.
Cardo Connexion