Zambia

The Data Protection Act, 2021 requires a lawful basis before processing personal data, and restricts processing of sensitive personal data, including biometric and genetic data, a child's data, political opinions, and health status, to specified grounds. A data controller must notify the Data Protection Commissioner within twenty-four hours of a security breach affecting personal data, and notify the affected data subject as soon as practicable.

A data subject has rights of access, rectification, erasure, and objection, and a right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects without human intervention. Personal data must, by default, be processed and stored on a server or data centre located in Zambia. Sensitive personal data must remain in Zambia. A data subject may nonetheless consent to a transfer of their sensitive personal data abroad.

A data controller or processor must register with the Data Protection Commissioner before processing personal data.

A body corporate that contravenes the Part IV processing principles faces a fine of up to one hundred million penalty units, valued at ZMW 0.40 each since 19 April 2024 (ZMW 40,000,000), or two percent of annual turnover, whichever is higher, and a natural person instead faces a fixed fine of up to one million penalty units (ZMW 400,000) or imprisonment of up to five years, or both.

Section 3(1) prohibits intentionally and without lawful authority or in excess of authority, infringing a security measure to access or monitor a computer system, or any part of a computer system, of another person. Contravention carries a fine of up to five hundred thousand penalty units, valued at ZMW 0.40 each since 19 April 2024 (ZMW 200,000), or imprisonment of up to five years, or both.

Because the offence's trigger is infringing a security measure, a person who reads a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision. This section narrows the unauthorised-access offence it replaced: section 49 of the repealed Cyber Security and Cyber Crimes Act, 2021 penalised accessing or intercepting data without authority or exceeding authorised access, with no express requirement to infringe a security measure.

Section 21(1)(c) provides that fair dealing with a work for the purpose of reporting current events does not infringe copyright, whether done in a newspaper, magazine, or similar periodical provided there is a sufficient acknowledgement, or by broadcasting, inclusion in a cable program service, or use in an audiovisual work, for which the Act states no acknowledgement requirement.

Section 21(1)(b) separately exempts fair dealing for criticism or review, provided there is a sufficient acknowledgement. Neither exception is capped at a headline-length or short-extract threshold. Whether either reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a newspaper's own current-events report, has not been tested in a reported Zambian decision.

Zambia has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognised hot-news or misappropriation doctrine distinct from ordinary copyright law, and no located case law on hyperlinking or framed display.

The Act's definition of a compilation confers copyright, not a sui generis database right, on a compilation that is a product of creativity by reason of the selection or arrangement of its contents, and the Act predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists either.