Data Protection Act, 2021
zm-dpa-2021 · Act
The Data Protection Act, 2021 (Act No. 3 of 2021) is Zambia's primary data protection legislation, enacted by Parliament on 23 March 2021. It establishes Zambia's first comprehensive statutory framework for the protection of personal data and creates the Office of the Data Protection Commissioner, operating as the Data Protection Commission, within the Ministry responsible for communications, as the primary regulatory and enforcement authority. The Act applies to data controllers and processors operating in Zambia, and extends extraterritorially to entities based outside Zambia where they target Zambian data subjects or process data relating to individuals in the country. Both public and private bodies are subject to the Act's obligations. Data controllers are required to register with the Data Protection Commission before commencing processing activities and must comply with the Act's data processing principles, including purpose limitation, data minimisation, accuracy, storage limitation, and security of personal data. Controllers are also required to appoint data protection officers and implement security measures appropriate to the risk profile of their processing activities. Data subjects are granted rights of access to personal data held about them, rectification of inaccurate data, and erasure in defined circumstances. The Act restricts cross-border transfers of personal data to third countries that do not provide adequate data protection, subject to exceptions including consent of the data subject and appropriate contractual safeguards. The Data Protection Commission is responsible for maintaining the register of data controllers, processors, and data auditors; providing regulatory guidance; conducting investigations; and enforcing compliance with the Act. The Commission may investigate complaints brought by data subjects and take enforcement action against non-compliant controllers and processors. Although the Act was enacted in March 2021, formal public enforcement by the Commission was not commenced until March 2025, following the finalisation of implementing instruments. The Data Protection (Registration and Licensing) Regulations, 2021 supplement the primary Act with requirements for registration and licensing of data controllers and processors.
- Data controllers and processors required to register with the Data Protection Commission before commencing processing
- Data processing principles apply including purpose limitation, data minimisation, accuracy, storage limitation, and security
- Data subjects granted rights of access, rectification, and erasure of personal data
- Cross-border transfers restricted to countries with adequate protection or on the basis of consent or appropriate contractual safeguards
- Data controllers required to appoint data protection officers and implement risk-appropriate security measures
- Data Protection Commission responsible for registration, enforcement, guidance, and international coordination
- Formal enforcement by the Commission commenced March 2025; supplemented by the Data Protection (Registration and Licensing) Regulations, 2021