Cyber Crimes Act, 2025 (No. 4 of 2025) (Zambia)

The Cyber Crimes Act, 2025 (Act No. 4 of 2025) is Zambia's principal statute creating cybercrime offences. Signed by President Hakainde Hichilema on 8 April 2025 and brought into operation on 15 April 2025, it repealed and replaced the offence provisions of the Cyber Security and Cyber Crimes Act, 2021 as part of a deliberate split between criminal-law and regulatory functions, the companion Cyber Security Act, 2025 (Act No. 3 of 2025) handles critical-infrastructure regulation and the Zambia Cyber Security Agency. The Cyber Crimes Act provides for offences relating to computers and computer systems, the protection of persons against cybercrime, and child online protection. Substantive offences include unauthorised access to computer systems (section 3, punishable by up to 500,000 penalty units or five years' imprisonment), unauthorised interference with data or systems (section 4, comparable penalties), illegal acquisition of data, unauthorised disclosure of data relating to critical information or critical information infrastructure, computer-related fraud and forgery, and a dedicated set of child online protection offences. On procedure, the Act equips law-enforcement officers with powers including search and seizure of computers under warrant (section 27), expedited preservation orders requiring data to be preserved for up to seven days, extendable by court (section 30), disclosure of traffic data under warrant to identify communication paths (section 31), and court-ordered real-time collection of specified traffic data (section 32). Enforcement involves the Zambia Police alongside the institutions established under the companion Cyber Security Act. The Act has attracted significant criticism from digital-rights organisations (including CIPESA, ICNL and commentators in the Journal of Democracy) over broad surveillance and interception powers and potential chilling effects on expression ahead of Zambia's 2026 elections. For the ATLPF library it is tagged Cybercrime and cross-referenced to the Cyber Security Act, 2025 and Zambia's Data Protection Act, 2021.

1. 1Offences: unauthorised access (s.3, up to 500,000 penalty units / 5 years); unauthorised interference with data or systems (s.4); illegal acquisition of data; unauthorised disclosure of critical-infrastructure data; computer-related fraud and forgery
2. 2Dedicated child online protection offences
3. 3Procedural powers: search and seizure of computers under warrant (s.27); expedited preservation orders up to 7 days, court-extendable (s.30); disclosure of traffic data under warrant (s.31); real-time collection of traffic data by court order (s.32)
4. 4Repeals and replaces the offence provisions of the Cyber Security and Cyber Crimes Act, 2021; split from the regulatory Cyber Security Act, 2025 (No. 3 of 2025)
5. 5Signed 8 April 2025; came into operation 15 April 2025
6. 6Criticised by digital-rights groups (CIPESA, ICNL) over surveillance, interception and free-expression concerns