Zambia

Data Protection Act, No. 3 of 2021 IN FORCE

commenced 2021-03-24 (assent); enforcement operational from 2025 · Official full text ↗

Scope

Processing of personal data performed wholly or partly in Zambia; controllers/processors domiciled in Zambia.

Key obligations

Mandatory registration/licensing of controllers and processors (deadline 30 Apr 2025); Processing principles, consent, children's data protections; Data localisation: sensitive personal data to be stored on a server/data centre in Zambia

DPO required

Controllers must appoint a data protection officer.

Registration

Yes: criminal offence to default (fine ~ZMW 200,000 and/or up to 5 years).

Cross-border transfers

S27 primary-text correction (2026-07-11): s. 70(1) requires ALL personal data to be processed and stored on a server or data centre located in Zambia; the Minister may prescribe categories storable abroad (s. 70(2)); sensitive personal data must ALWAYS be processed and stored in Zambia with no carve-out (s. 70(3)). Non-exempt data may be transferred out only on consent PLUS Commissioner-approved standard contracts/intragroup schemes (with liability certification, s. 71(5)-(6)) or a ministerial prescription applying adequacy criteria (s. 71(2)), or on Commissioner-approved necessity; emergency transfers to health/emergency services and explicit-consent sensitive-data transfers are the s. 71(4) derogations. Earlier 'sensitive data only' localization descriptions understate the statute.

Breach notification

Section 49 ('Notification of security breach'): the controller must notify the Data Protection Commissioner within 24 hours of any security breach affecting personal data processed; a processor notifies the controller as soon as practicable (s.49(2)); the controller or processor must notify the data subject as soon as practicable (s.49(3)). An absolute 24-hour clock with no risk threshold.

Penalties

Fines (penalty units), imprisonment, and turnover-linked penalties for corporate offenders.

Authority

Office of the Data Protection Commissioner / Data Protection Commission (dataprotection.gov.zm)

Verified 2026-07-06

Access to Information Act No. 24 of 2023 IN FORCE