LexLint

Know the law your code answers to.

Law / Zambia

Data Protection Act, 2021, offences, penalties, complaints and redress

Data Protection Act, 2021, ss. 18, 55 and 68-77 (offences, penalties, complaints and redress)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 April 2021.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • Expect a data subject to be able to complain to the Data Protection Commissioner about your processing, and to appeal the Commissioner's decision to the High Court within thirty days of it.
  • Expect a data subject who suffered damage from an infringement to be able to claim compensation from you as a court determines.
  • Expect the Data Protection Commissioner or a licensed independent data auditor to audit your policies and your processing of personal data annually, and to bear the cost of auditing any server you were authorised to keep outside the Republic.
  • Note that a director, manager, shareholder or partner who knew of, consented to or connived in an offence under the Act is personally liable to the penalty specified for it.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

A natural person convicted of contravening the Part IV personal-data processing principles is liable to a fine of up to one million penalty units (ZMW 400,000) or imprisonment of up to five years, or both (s. 18(2)).

Penalty structure

Applies to a body corporate that contravenes the Part IV processing principles (s. 18(1)); stated in the Act as one hundred million penalty units, valued at ZMW 0.40 each under the Fees and Fines (Fee and Penalty Unit Value) (Amendment) Regulations, 2024. A natural person instead faces a fixed fine of up to one million penalty units (ZMW 400,000) or imprisonment of up to five years, or both (s. 18(2)), and a residual general penalty of up to three hundred thousand penalty units (ZMW 120,000) or three years' imprisonment applies under s. 77 to an offence under the Act with no specified penalty.

Rule
Higher of
As of
5 September 2026
Currency
ZMW
Fixed cap
40,000,000
Turnover percentage cap
2

Who enforces it

Enforcement body

Office of the Data Protection Commissioner

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 18(1) makes a body corporate that contravenes the Part IV processing principles liable on conviction to a fine of up to one hundred million penalty units, valued at ZMW 0.40 each since 19 April 2024, or two percent of annual turnover of the preceding financial year, whichever is higher; section 18(2) makes a natural person liable instead to a fine of up to one million penalty units or imprisonment of up to five years, or both.

Section 55 sets the same two-percent-or-two-million-penalty-unit structure for the Part VIII duties of a data controller, with ten years' imprisonment for a natural person. Section 68 lets a data subject lodge a complaint with the Data Protection Commissioner, and section 69 lets a person aggrieved by the Commissioner's decision appeal to the High Court within thirty days of it.

Section 72 entitles a data subject who has suffered damage from an infringement to compensation from the data controller or data processor as a court determines.

Section 73 makes unlawfully disclosing sensitive personal data an offence carrying up to two hundred thousand penalty units or two years' imprisonment, section 74 lets the Commissioner compound an offence for up to half the maximum fine, section 75 lets a court order forfeiture of the medium holding the data and bar the convicted person from managing any processing for a period, section 76 reaches a director, manager, shareholder or partner who knew of, consented to or connived in the offence, and section 77 sets a residual penalty of up to three hundred thousand penalty units or three years' imprisonment where no specific penalty is provided.

Section 81 has the Commissioner or a licensed independent data auditor audit a data controller's policies and processing annually. Section 1 leaves commencement to a statutory instrument appointed by the Minister. The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on 1 April 2021, which is the day these provisions began to bind.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • high_risk_decisions
  • is_listed_company

Read the law

Official Act text as published by the National Assembly of Zambia (Parliament of Zambia)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app