Zambia. Comprehensive data protection. Act
Zambia DPAData Protection Act, 2021 (Act No. 3 of 2021)
In force
§1Summary
- Synopsis
Zambia's data protection law regulating processing of personal data and establishing the Data Protection Commissioner. It combines GDPR-style rights with registration and strong localisation provisions.
- Key themes
- Unique features
Registration certificates are valid for only one year, and data auditors need a separate licence. Personal data must by default be processed and stored on servers in Zambia (sensitive data always), and breaches must be notified to the Commissioner within 24 hours.
- SaaS relevance
Foreign-hosted SaaS faces a localisation default unless the Minister prescribes categories that may be stored abroad, plus annual registration.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Commissioner within 24h; data subjects as soon as practicable
- DPO
- Yes
- Cross-border transfers
- Localisation default; consent plus approved contracts/intragroup schemes or Commissioner approval
- Maximum penalty
- Greater of 100m penalty units or 2% of annual turnover (corporates)
§3Dates
- Key dates
- Adopted
- In force
- Commencement order 2021-04-01; Office of the Data Protection Commissioner operational 2025
§4Text and authority
- Text
- Authoritative text zambialii.org
- Authority
- Office of the Data Protection Commissioner (Data Protection Commission)
§5Where it applies
- Domestic law of
- Zambia
§6Sources and verification
- Sources consulted
- Verification
High confidence.