Data Protection Act, 2021, rights of the data subject

Data Protection Act, 2021, ss. 58-67 (rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 April 2021.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Let a data subject access, correct, delete, or restrict the personal data held about them, and do not subject them to a decision based solely on automated processing that has legal or similarly significant effects without human intervention.
Answer an access request with the purpose, the categories of data and of recipients, the storage period or the criteria that set it, the data and its source, and the basic logic of any automated decision-making, free of charge for the first copy and in a commonly used electronic format where the request came electronically.
Tell the data subject every third party their personal data has been disclosed to, and what safeguards are in place for it.
Stop processing personal data for direct marketing as soon as the data subject objects, and bring the rights of objection to their attention clearly and separately at your first communication with them.
Where an automated decision rests on a contract, a written law or explicit consent, put suitable safeguards in place, including the right to obtain human intervention, to put a point of view and to contest the decision, and do not process sensitive personal data automatically at all unless the data subject expressly consented, the processing is in the public interest, or a written law permits it with safeguards.
Communicate every rectification, erasure or restriction of processing to each recipient the personal data was disclosed to, where practicable.
Give a data subject their personal data in a structured, commonly used, machine readable or otherwise legible format, and transmit it directly to another controller where that is technically or otherwise feasible.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 58 gives a data subject confirmation of whether their personal data is being processed and access, in terms they understand, to the purpose, the categories of data and of recipients, the envisaged storage period or the criteria that set it, the data and its source, and the basic logic involved in any automated decision-making, along with notification of every third party the data was disclosed to and the safeguards put in place; the first copy is free and further copies carry a reasonable administrative fee, and an electronic request is answered in a commonly used electronic format.

Section 59 gives a right to rectification of inaccurate personal data as soon as practicable and to completion of incomplete data.

Section 60 gives a right to erasure as soon as practicable, with the controller obliged to erase without undue delay where the data is no longer necessary, where consent is withdrawn and no other ground exists, where the data subject objects and no overriding legitimate ground exists, where the processing was unlawful, or where a legal obligation requires it, and requires reasonable steps to tell processors and third parties processing data the controller made public.

Section 61 gives a right of objection, including an objection to direct marketing that ends processing for that purpose, and requires the rights to be brought to the data subject's attention clearly and separately at the first communication.

Section 62 bars a decision based solely on automated processing, including profiling, that produces legal effects or similarly affects the data subject, except on contract, written law or explicit consent, and then only with suitable safeguards including human intervention so the data subject can put their point of view and contest the decision; automated processing of sensitive personal data is barred outright unless the data subject has expressly consented, it is in the public interest, or a written law permits it with safeguards in place.

Section 63 gives a right to restriction of processing, section 64 fixes the information to be given when personal data is collected directly from the data subject, section 65 gives a right to data portability, and section 66 requires any rectification, erasure or restriction to be communicated to every recipient the data was disclosed to where practicable. Section 1 leaves commencement to a statutory instrument appointed by the Minister.

The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on 1 April 2021, which is the day these provisions began to bind.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Official Act text as published by the National Assembly of Zambia (Parliament of Zambia)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app