Zambia

The Data Protection Act, 2021 sets its reach by how data is handled, not by where your company sits. Kenya, Nigeria and Ghana each have a clause that catches a foreign company aiming at their residents. Zambia has no such clause. So no Zambian court has ever settled whether the Act covers a company based only abroad. What is clear is what the regulator expects. The Ministry of Technology and Science published a registration guideline in January 2025. It says all persons and entities in all sectors that handle personal data must register. Their annual turnover, revenue and number of employees make no difference. The only people left out are individuals using data for their own personal use. The registration form, Form I, Part 5, is headed 'Representative in Zambia'. Businesses and individuals representing a foreign entity fill it in. You give the name, address, phone number and email of your representative in Zambia. Registering is not optional. Handling personal data without registering is a crime and can mean up to five years in prison.

The Data Protection Act, 2021 says you must keep and use personal data on a server or in a data centre in Zambia. That is a flat rule. The Minister can name kinds of personal data that are allowed to be stored outside Zambia. That power has never been used, so nothing is released from the rule today. Sensitive personal data is shut out of that power altogether, so it can never be released this way. The regulator reads 'storing data outside Zambia' very widely. It covers an off-site data recovery site abroad. It covers a cloud service that stores data abroad. It covers anything else that ends with your data sitting outside Zambia. If you answer yes to that question on the registration form, you have to apply for a separate permission to store personal data outside Zambia. A second rule sits on top. The Cyber Security Act, 2025 says critical information, and the systems that run it, must be hosted inside Zambia. The Zambia Cyber Security Agency can allow hosting abroad, case by case. It names eleven critical industries. They are defence and security, the public sector, banking and finance, health, transport, pensions and insurance, information and communications technology, energy, education and mining. That duty only starts for you once the Agency names your information as critical in the government gazette. We found no such notice on any government source as at 18 August 2026. So this rule exists but is not yet switched on for anyone. Two industries add more. In payments, we found no rule about where data must sit. But the Bank of Zambia now makes electronic money firms give it live read-only access to their platforms. In telecoms, the subscriber and device registers must sit on the operator's own network, with an unbroken link to the regulator's central register in Zambia. In health research, sending human biological samples abroad needs approval first from the National Health Research Authority. That comes with a material transfer agreement, which also controls who can reach the data produced from the samples.

The Data Protection Act, 2021 sets out the routes for any personal data the Minister has not released from the storage rule. Route one: the person the data is about agrees, and one of two extra things is true. Either the transfer runs under standard contracts or group-wide schemes approved by the Data Protection Commissioner. Or the Minister has ruled that transfers out of Zambia are allowed. Route two: the Commissioner approves your particular transfer, or a set of transfers, because there is a real necessity. The Act adds a few narrow exceptions. They cover emergencies involving health or emergency services. They cover explicit consent for sensitive personal data. And they cover sending data to an international organisation, or to a country the Commissioner is satisfied about. If you rely on an approved standard contract, the work does not stop there. You must confirm to the Commissioner that the contract is being honoured, and report on that from time to time. You also carry the liability if the company receiving the data causes harm by breaking the rules. The catch is that the approved lists are empty. As at 18 August 2026 the Commission's resources page held eleven documents. They are the Act, the 2021 registration regulations, registration forms and guides, a code of conduct, a breach management guide and a records guide. There is no approved set of standard contracts. There is no list of approved countries. There is no guidance at all on sending data abroad. Two more points. The regulator treats storing data abroad as needing its own permission, on top of any transfer approval. And if you are allowed to use a foreign server, you pay the cost of auditing it.

The Data Protection Act, 2021 set up the Office of the Data Protection Commissioner inside the ministry that covers communications. That is the Ministry of Technology and Science. The Commission's own team page names Likando Luywa as Data Commissioner. Registration really works. There is an online portal and a manual route by email. The fees are published. An individual or a very small organisation pays about 67 kwacha to apply and 667 kwacha for the certificate. A large organisation, or a company that handles data for others, pays up to 400 kwacha to apply and 4,000 kwacha for the certificate. The Bank of Zambia rate on 18 August 2026 was about 18.74 kwacha to the United States dollar. So the largest of those fees is roughly 215 dollars. Certificates last twelve months and you must renew them. The signs of a young regulator are easy to spot. The Audit Guidelines page and the Other Guidelines page both still show Latin placeholder text. The team page still lists a made-up second member. The only press release on the site opens to a blank page. The published documents have download counts in the low hundreds. The Commission is not the only body that can act. Most of the punishments in the Act are crimes, so they go through the courts. People can also sue you for compensation. Three other regulators work nearby. The Zambia Information and Communications Technology Authority covers telecoms. The Zambia Cyber Security Agency, created in 2025, covers cyber security. The Bank of Zambia covers payments, and in July 2025 it issued a data access order with a firm deadline.

The Data Protection Act, 2021 sets a minimum. You must keep personal data while you are using it for the purpose you collected it for. You must keep it while it is still relevant to that purpose. Then you must keep it for at least one year more. A shorter period could be set by rules, and none has been. So one year is a hard minimum, not a maximum. The Act pulls the other way too. It says data must be stored in a form that identifies people for no longer than you need. It also gives people a right to have their data deleted without undue delay. That right applies once the data is no longer needed, once consent is withdrawn, or once your use of the data is found unlawful. There is a separate duty to keep records of why you collected data, who you shared it with, and when. Zambia gives no rule for which of these wins. The sensible reading is that the specific one-year minimum beats the general principle. So if someone asks you to delete data inside that year, lock it away and stop using it rather than destroying it. No Zambian court has tested that reading. In telecoms, the 2011 device registration regulations were amended in January 2026. An operator must keep the information in its equipment identification register for three years after the device was last used. Zambian tax and company law set longer minimums too. We did not check those for this record.

The Data Protection Act, 2021 gives you 24 hours to tell the Data Protection Commissioner about any security breach affecting personal data you hold. There is no harm test and no risk filter. As written, every security breach involving personal data must be reported. If you handle data for another company, you must tell that company as soon as you can. The person whose data was exposed must also be told as soon as you can. The Commission publishes a guide on handling data security breaches and hosts an online breach report form. The second clock comes from the Cyber Security Act, 2025. If you hold information the government has named critical, you must tell the Zambia Cyber Security Agency straight away about any incident, suspected or real. You then send a written first report within twelve hours, and a full report once the incident is over. The Agency can also set intervals for progress reports. Missing this can cost up to five hundred thousand penalty units or five years in prison. The twelve-hour duty only applies once your information has been named critical in the government gazette. We found no such notice as at 18 August 2026. The overlap is the real danger. One incident at a bank or a hospital could set off a twelve-hour cyber report and a 24-hour privacy report. That means two different regulators and two different forms.

Trap one is the clash between the one-year minimum and the right to have data deleted. It is described in the retention answer. Trap two is the data protection officer. The Data Protection Act, 2021 says every company that decides how data is used, and every company that handles data for others, must appoint one. Guidelines will say how. Europe only requires this above a certain scale or sensitivity, or for public bodies. Zambia sets no trigger at all. Trap three is the yearly audit. The Commissioner, or an independent licensed data auditor, audits your policies and your handling of data every year. If you were allowed to use a foreign server, you pay the cost of auditing it. Data auditors must themselves be licensed. Trap four is the punishment. A company that breaks the rules on handling personal data faces a fine. The cap is one hundred million penalty units, or two percent of last year's turnover, whichever is higher. At forty ngwee per penalty unit, that fixed cap is forty million kwacha, roughly 2.1 million United States dollars. An individual faces up to one million penalty units or five years in prison. Handling personal data without registering carries up to five hundred thousand penalty units or five years. Unlawfully disclosing sensitive personal data carries up to two hundred thousand penalty units or two years. A director, manager, shareholder or partner is personally liable if the offence happened with their knowledge, consent or help. A court can also seize whatever the data was stored on, and ban a convicted person from running any data work at all. Trap five is children. Zambia's Constitution says a child is anyone under eighteen. You need a parent's or guardian's consent, and you must build age checks and parental consent into your product. There is a sixth, quieter trap. Mobile lines now need biometric data. The January 2026 change to the device registration regulations makes operators send subscriber biometric data to the telecoms regulator. It also makes a parent or guardian the registered subscriber for any line a child uses, until that child turns eighteen.

Switch one would loosen things. The Minister can name kinds of personal data that are allowed to be stored outside Zambia. The power has existed since the Act started on 1 April 2021 and has never been used. One short set of rules could free most ordinary business data from the storage duty overnight. Switch two would also loosen things. The Data Protection Commissioner can approve standard contracts and group-wide schemes. None have been approved or published. That is why the main legal route for sending data abroad is closed today. If an approved set were published, Zambia would move from case-by-case approval to something closer to paperwork. Switch three would tighten things. The Zambia Cyber Security Agency can publish a notice in the government gazette naming information or infrastructure in eleven critical industries as critical. From the date of that notice, you would have thirty days to register with the Agency. You would have to host that information inside Zambia unless you got separate permission. You would have to appoint an information technology auditor every year. And you would fall under the twelve-hour incident report. We found no such notice on any government source as at 18 August 2026. Two other things are worth watching. The Ministry of Technology and Science has asked the public for comments on a review of the older cyber security law. And the Cyber Security Act, 2025 and the Cyber Crimes Act, 2025 both still need detailed rules, which had not appeared by August 2026. A single notice can change the storage rules in either direction, so we check this record every sixty days.