LexLint

Know the law where your app runs.

Law / Zambia

Data Protection Act, 2021, personal data processing framework

Data Protection Act, 2021 (Act No. 3 of 2021)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 1 April 2021.

A comprehensive regime rule binding public and private bodies.

As of 5 September 2026.

What it requires

  • Before processing personal data, establish a lawful basis such as consent, a contract, a legal obligation, or a legitimate interest, and process it fairly, transparently, and only for the purpose collected.
  • Obtain explicit consent, or rely on another applicable ground, before processing sensitive personal data, including biometric or genetic data, a child's data, political opinions, or health information.
  • Notify the Data Protection Commissioner within twenty-four hours of a security breach affecting personal data, and notify the affected data subject as soon as practicable.
  • Let a data subject access, correct, delete, or restrict the personal data held about them, and do not subject them to a decision based solely on automated processing that has legal or similarly significant effects without human intervention.
  • Store and process personal data on a server or data centre located in Zambia unless the Minister has prescribed an exception, and do not store sensitive personal data outside Zambia without the data subject's explicit consent.
  • Register with the Data Protection Commissioner as a data controller or data processor before controlling or processing personal data.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

A natural person convicted of contravening the Part IV personal-data processing principles is liable to a fine of up to one million penalty units (ZMW 400,000) or imprisonment of up to five years, or both (s. 18(2)).

Penalty structure

Applies to a body corporate that contravenes the Part IV processing principles (s. 18(1)); stated in the Act as one hundred million penalty units, valued at ZMW 0.40 each under the Fees and Fines (Fee and Penalty Unit Value) (Amendment) Regulations, 2024. A natural person instead faces a fixed fine of up to one million penalty units (ZMW 400,000) or imprisonment of up to five years, or both (s. 18(2)), and a residual general penalty of up to three hundred thousand penalty units (ZMW 120,000) or three years' imprisonment applies under s. 77 to an offence under the Act with no specified penalty.

Rule
Higher of
As of
5 September 2026
Currency
ZMW
Fixed cap
40,000,000
Turnover percentage cap
2

Who enforces it

Enforcement body

Office of the Data Protection Commissioner

What it reaches

Obligation class

Consent, Disclosure, Data subject rights, Transfer, Security, Breach notice, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Data Protection Act, 2021 requires a lawful basis before processing personal data, and restricts processing of sensitive personal data, including biometric and genetic data, a child's data, political opinions, and health status, to specified grounds. A data controller must notify the Data Protection Commissioner within twenty-four hours of a security breach affecting personal data, and notify the affected data subject as soon as practicable.

A data subject has rights of access, rectification, erasure, and objection, and a right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects without human intervention. Personal data must, by default, be processed and stored on a server or data centre located in Zambia. Sensitive personal data must remain in Zambia. A data subject may nonetheless consent to a transfer of their sensitive personal data abroad.

A data controller or processor must register with the Data Protection Commissioner before processing personal data.

A body corporate that contravenes the Part IV processing principles faces a fine of up to one hundred million penalty units, valued at ZMW 0.40 each since 19 April 2024 (ZMW 40,000,000), or two percent of annual turnover, whichever is higher, and a natural person instead faces a fixed fine of up to one million penalty units (ZMW 400,000) or imprisonment of up to five years, or both.

When LexLint raises it

  • crawls_web
  • trains_models
  • processes_biometrics
  • high_risk_decisions

Read the law

Official Act text as published by the National Assembly of Zambia (Parliament of Zambia)

Back to the example  ·  Lint your app