Zambia

Zambia regulates personal data through the Data Protection Act, 2021 (Act No. 3 of 2021), enacted by Parliament on 23 March 2021. The Act establishes Zambia's first comprehensive statutory framework for personal data protection and creates the Office of the Data Protection Commissioner, operating as the Data Protection Commission within the Ministry responsible for communications. It applies to controllers and processors operating in Zambia and extends extraterritorially to entities outside Zambia that target Zambian data subjects or process data relating to individuals in the country, covering both public and private bodies. Controllers must register with the Commission before processing and comply with the Act's principles, purpose limitation, data minimisation, accuracy, storage limitation, and security, as well as appoint data protection officers and implement risk-appropriate security measures. Data subjects hold rights of access, rectification, and erasure. Cross-border transfers are restricted to countries with adequate protection, subject to exceptions including consent and appropriate contractual safeguards; the Act is also associated with data-localisation-style requirements for certain sensitive data in practice. The framework is supplemented by the Data Protection (Registration and Licensing) Regulations, 2021. A notable feature of Zambia's trajectory is the gap between enactment and enforcement: although the Act was passed in March 2021, formal public enforcement by the Commission only commenced in March 2025, following finalisation of implementing instruments. The Commission maintains the register of controllers, processors, and auditors, provides guidance, investigates complaints, and coordinates regionally and internationally. Zambia therefore has an in-force statute, supporting registration regulations, and a regulator that has only recently become active in enforcement.