Data Protection Act, 2021, notification of a security breach

Data Protection Act, 2021, s. 49 (notification of a security breach)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 April 2021.

A breach notification rule binding public and private bodies.

As of 19 September 2026.

What it requires

Notify the Data Protection Commissioner within 24 hours of the breach occurring: section 49(1) runs the period from the security breach itself, not from the moment you learn of it.
Notify the affected data subject as soon as practicable of any security breach affecting their personal data.
As a data processor, notify the data controller as soon as practicable of any security breach affecting personal data you process on its behalf.
Treat every security breach affecting personal data as notifiable: the Act sets no risk threshold below which the duty falls away.

What it reaches

Obligation class

Breach notice, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 49(1) requires a data controller to notify the Data Protection Commissioner within twenty-four hours of any security breach affecting personal data processed, a period the Act runs from the breach itself rather than from the moment the controller becomes aware of it. Section 49(2) requires a data processor to notify the data controller, as soon as practicable, of any security breach affecting personal data processed on the controller's behalf.

Section 49(3) requires a data controller or data processor to notify the data subject, as soon as practicable, of any security breach affecting personal data processed. None of the three duties is qualified by a risk threshold: the Act attaches them to any security breach affecting personal data, not only to one likely to cause harm. Section 82(2)(b) lets the Minister make regulations on the notification of security breaches, so the detail may be prescribed later.

Section 1 leaves commencement to a statutory instrument appointed by the Minister. The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on 1 April 2021, which is the day these provisions began to bind.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
operates_essential_service

Read the law

Official Act text as published by the National Assembly of Zambia (Parliament of Zambia)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app