🇿🇼Zimbabwe eSIM: What S.I. 95 of 2014 Requires of a Local SIM

1 plan for Zimbabwe: 1 GB at $18.99. The profile is data-only: no local number, no shop and no queue — it arrives as a QR code by email. Our retail prices from the operator catalogue, checked 28 September 2026.

Does Zimbabwe’s SIM-registration law reach this eSIM?

eSIM Zimbabwe is a foreign-issued roaming profile, not a Zimbabwean subscriber line, so it sits outside S.I. 95 of 2014’s activation duty for a local Subscriber Identity Module (SIM) card. No. S.I. 95 of 2014 registers a Zimbabwean subscriber line before a local operator activates it (section 3(1)). This eSIM for Zimbabwe is a roaming profile from Zimcom, riding Econet’s 4G network under a number POTRAZ never issued.

Airalo’s catalog marks it is_kyc_verify: false: no ID document, no passport number at checkout. Both catalog facts were read from Airalo’s Zimbabwe listing on 1 September 2026. The regulation targets a different transaction: a person handing over a SIM card inside Zimbabwe, not a traveller loading a data profile before a flight.

You will also find Zimbabwe on lists of countries where an eSIM supposedly fails. One travel-eSIM blog files it with Iran, Myanmar and Venezuela and says eSIMs there “may technically work” (blivale.com, 22 October 2025 — read as a search-result snippet, not the page itself). The word “eSIM” appears nowhere in S.I. 95 of 2014, nowhere in its 2019 amendment, and nowhere in the committee report that preceded both. Section 3(1) speaks of a “SIM-card” that a service provider activates on its own network. The rule binds the operator switching on a line, not the format of the card in your phone.

What does S.I. 95 of 2014 require before a line activates?

Section 3(1) bars a service provider from activating a SIM card, or providing service at all, until the customer’s details are registered under section 4. Anyone already active in 2014 had 30 days to register. A provider had the same 30 days to deactivate anyone who didn’t (sections 3(3) and 3(4)).

For a natural person, section 4(1)(a) lists six items: full name, permanent residential address, nationality, gender, and subscriber identity number. The sixth is either a national identification number or a passport number — the text reads “or,” not “and.” A legal person supplies its registration certificate, the representative’s ID details, the company’s name and address, its registration number where one exists, and a subscriber identity number (section 4(1)(b)). The provider must then verify the customer’s names, ID number, address and identity (section 4(2)).

Two duties sit alongside the paperwork. A customer must report any change to that information within 21 days (section 4(6)). A provider’s employee who suspects a submitted ID is false must report it to police within 24 hours (section 4(7)). Knowingly giving false registration details is itself an offence. It carries a fine “not exceeding level five,” up to six months' imprisonment, or both (section 4(8)).

What’s inside POTRAZ’s central subscriber database?

The regulator keeps its own copy. Section 8(1) makes POTRAZ — the Postal and Telecommunications Regulatory Authority — build and hold a “Central Subscriber Information Database,” separate from any one operator’s list. Every provider feeds it monthly, “or at such regular intervals as the Authority may... specify” (section 8(3)).

Section 8(2) says what the file is for, in the statute’s own verbs: to monitor whether providers follow the rules, to help run emergency calls, to assist law enforcement and national security, to send emergency warnings to phones, and to authorise research in the sector. Section 8(10) then lists the grounds on which anyone may reach the data — and it is the same list, with POTRAZ checking operator accuracy in place of monitoring compliance. The reasons to build the file and the reasons to open it are one list of five.

Only “authorised personnel” may go in: section 8(5) says “no persons or entities” beyond them get access, and POTRAZ appoints data controllers of its own (section 8(6)). POTRAZ and every provider must “preserve the integrity and prevent any corruption, loss or unauthorised disclosure” of what they hold (section 8(9)) — the one subsection the penalty clause names by number. A police request needs “a warrant or court order” before POTRAZ hands anything over (section 9(2)).

One line sits under all of it: “the subscriber information shall not be transferred outside the Republic of Zimbabwe” (section 8(11)). That is an absolute data-localisation rule, until the 2019 amendment carves an exception into it. The text never mentions roaming. What it does say is that providers send POTRAZ what sits in their subscriber registers (section 8(3)), and a profile that was never registered under section 4 never enters one. On that reading nothing about a traveller’s roaming profile reaches the central database. The regulations do not say so in terms.

What does the 2019 amendment change about foreign cloud hosting?

One narrow exception now cuts into that line. S.I. 250 of 2019 leaves registration untouched and inserts two subsections, 8(11a) and 8(11b), directly under section 8(11). A Zimbabwean operator can use a foreign cloud host after all — but only if five conditions all hold.

The data must be “encrypted in such a way that it cannot be read by the foreign host” (8(11b)(a)). The Zimbabwean operator, not the cloud provider, must retain the encryption keys. No third party — “including the cloud-service provider” — can then open the file (8(11b)(b)). A report on the protective steps, plus the hosting agreement, must reach POTRAZ before the contract is signed (8(11b)(c)). The subscriber’s consent must come by “a clear affirmative act establishing a freely given, specific, informed and unambiguous consent... in writing” (8(11b)(d)). The operator is barred outright from “selling, trading and sharing” whatever data crosses to the foreign host (8(11b)(e)). Section 8(11a) frames the carve-out as one for data storage services, not a general licence to move subscriber data abroad.

What did Parliament’s legal committee find in the 2013 version?

Parliament’s own lawyers called Zimbabwe’s first SIM-registration regulation unconstitutional, and it is not the one in force. Zimbabwe’s Parliamentary Legal Committee met on 18 and 20 November 2013 to consider S.I. 142 of 2013, the regulation that S.I. 95 of 2014 later repealed outright (section 13). The committee resolved unanimously: “the Committee resolved that Statutory Instrument 142 is unconstitutional.”

The objection centred on privacy and judicial oversight, not registration itself. The committee found the rules “potentially infringe” the Constitution’s right to privacy (section 57) and freedom of expression (section 61). Its own words: the rules “eliminat[e] the anonymity of communications... facilitat[e] location-tracking, and simplif[y] communications surveillance.” It also noted that Zimbabwe “does not have comprehensive data protection legislation,” leaving no judicial sign-off before subscriber data reached police.

One finding names an exact fix. Under the 2013 rules, a law-enforcement agent could pull central-database data on a written request from an official “with a rank coordinate to or above... Assistant Commissioner of Police.” No court was involved. The committee’s own recommendation: require “that the ranked official’s request be in the form of a warrant issued by a court.” S.I. 95 of 2014 replaced S.I. 142 of 2013 the following year, and the rank test is gone. Section 9(2) now conditions access on the official being “in possession of a warrant or court order.” No document we read links the two. Neither the report, nor the 2014 regulation, nor the 2019 amendment says the drafters wrote section 9(2) in answer to this committee. What can be said is narrower: the defect the committee named is no longer in the text.

Not everything changed. The committee also flagged that the rules released data for “approved educational and research purposes” without ever defining the term. That risked profiling under that label with no real consent. Section 8(10)(d) of S.I. 95 of 2014 still reads “undertaking approved educational and research purposes,” with no definition anywhere in the text. Nothing in these three documents says whether Zimbabwe has since passed the comprehensive data-protection law the committee wanted.

What happens if someone doesn’t comply?

Section 12(1) hits the provider side. A service provider, agent, distributor or dealer that contravenes sections 4, 5, 7, 8(9) or 9 faces “a fine not exceeding level 7 for each day on which such failure to comply continues.” That is a per-day penalty, not a one-off. Section 12(2) hits the customer side.

Failing to comply with sections 4, 6, 9, 10 and 11 carries “a fine not exceeding level 5 or a period of imprisonment not exceeding six months,” or both. Section 4(8) adds a third, narrower offence inside the registration section itself. Knowingly giving false details draws that same level-five-or-six-months penalty, apart from section 12. Zimbabwe’s fine “levels” are a scale of their own. None of the three documents says what a level converts to in dollars.

Section 12(2) reaches “any customer or person.” The duties it enforces belong to a registered local subscriber, or to someone let into the database. They are: registering, reporting a lost SIM, keeping data confidential, holding a research approval, destroying data after use. On a roaming profile you hold none of them.

Does Zimbabwe register your handset by IMEI?

No instrument requires it, on the law we have read as of 15 September 2026. Zimbabwe registers the subscriber, not the device: S.I. 95 of 2014 attaches to a SIM card an operator activates, and neither it nor the Postal and Telecommunications Act carries a handset register. That matters because the regulator has been asking for one in public. Five countries do run such a register, and what each of them demands differs enough that the distinction is worth keeping.

What exists is a lobbying position, reported once. Hasha Myambo, POTRAZ’s competition and standards manager, said that while an instrument already compels operators to register every SIM card they issue, “we are lobbying for a corresponding instrument that puts in place a Central Equipment Identification Database for handsets to which operators subscribe” (The Herald, 8 April 2025, read 15 September 2026). The report states the purpose plainly: such a database would let a stolen or lost device be blocked on every network shortly after it is reported. It names no draft instrument, no date and no fee, and we have found none published since.

The amendment bill in front of Parliament does not add one either. H.B. 10 of 2025 was approved by Cabinet on 29 July 2025 and still had not been presented when Veritas surveyed bills on 5 February 2026. Its text gives the minister power to make regulations on “the registration of SIM cards and subscriber information” and defines a SIM for the first time. The words IMEI and equipment identity do not appear in it. It would start “on a date to be fixed by the President by statutory instrument”, so even passage would not be the date.

Type approval, which does exist, points at sellers rather than at you. S.I. 12 of 2021 requires equipment used under a private radio licence to be type approved before it operates (section 33(1)), bars a licensee from supplying equipment that is not (section 33(6)), and puts the same duty on importers and distributors (section 46(3)); its schedule prices type approval of radio equipment at US$500. The duty falls on licensees, importers and dealers. A phone in a visitor’s pocket is named nowhere in it, and no network blocking mechanism is described.

What do you actually get with this Zimbabwe eSIM?

Airalo lists one eSIM for Zimbabwe as of this check: 1 GB over 7 days, for $19. It runs on Zimcom, roaming on Econet’s 4G network (Airalo catalog data, checked 1 September 2026). One is the whole shelf, not a ladder of day-tiers or an unlimited plan — the same catalog carries 12 packages each for Pakistan and Indonesia against this one.

The profile is rechargeable online, and the listing notes no expiry on it. Its day count starts on first use, not on purchase (Airalo, checked 1 September 2026), so buying it weeks ahead doesn’t shorten it. A purchased profile stays installable for up to 365 days, and after a plan ends a top-up window stays open for 90 days.

That is_kyc_verify: false flag ties back to the opening answer: nothing asks for your ID document or your identity number at activation. The check S.I. 95 of 2014 requires of a Zimbabwean line is simply not part of buying a roaming profile.

How do you install it, and where does coverage fall short?

Install the profile before you fly, on Wi-Fi. Airalo delivers it as a QR code or a direct install link, and both need a working connection. Confirm it shows as installed before you board; nothing activates yet, since the plan runs on first-usage activation. Turn on data roaming once you land and reach an Econet tower — that is where the day count starts, not at install.

Coverage runs on Econet’s 4G network, the same infrastructure Zimbabwean subscribers use. One gap comes straight from Airalo’s own catalog notes: “the coverage may not be available in the Victoria Falls region” (Airalo, checked 1 September 2026). It is the only region the listing singles out. Check Econet’s own coverage map before you count on this eSIM in Zimbabwe.

The profile is data-only, with no Zimbabwean phone number attached, so anything gated behind a local SMS code sits outside what it does. The iPhone install guide and the Android install guide cover the QR-scan and manual-entry steps.

FAQ

Sources and freshness

Checked against S.I. 95 of 2014 (Postal and Telecommunications (Subscriber Registration) Regulations, 2014) and its 2019 amendment, S.I. 250 of 2019, both distributed by Veritas Zimbabwe. Also checked against the Parliamentary Legal Committee’s adverse report on the predecessor S.I. 142 of 2013. The government PDFs carry recognition errors — “[Chapter J 2 :05]” for “[Chapter 12:05],” “pub] ication” for “publication” among them. We cross-checked every section number against the numbered body text itself, not the more garbled arrangement-of-sections list at the top of the file. Plan, network and activation details come from Airalo’s Zimbabwe catalog data, checked 1 September 2026, and can change without notice. The handset question above was checked on 15 September 2026 against S.I. 12 of 2021 (Licensing, Registration and Certification), the Postal and Telecommunications Amendment Bill H.B. 10 of 2025, and Veritas Bill Watch 2-2026 of 5 February 2026; the Central Equipment Identification Database exists in The Herald’s report of 8 April 2025, read in the original on 15 September 2026, and in no instrument we could find.

Sources cited only — expert review pending. For individualized advice, consult a licensed professional.