Zambia

Section 3 of the Data Protection Act, 2021 sets the scope by reference to the method of processing, not to the location of the organisation. Unlike Kenya, Nigeria or Ghana, Zambia has no express clause reaching a controller established outside the country who targets residents. That silence means the reach of the Act over a purely foreign business has never been settled by a Zambian court. What is clear is the practical position: the Ministry of Technology and Science guideline for registration (January 2025) states that, apart from individuals processing data for personal use, 'ALL PERSONS AND ENTITIES processing Personal Data IN ALL SECTORS regardless of their annual Turnover/ Revenue or number of employees are required to register'. Form I, Part 5, is headed 'Representative in Zambia' and is to be completed 'by entities and or individuals that represent a foreign entity or individual', with the name, address, phone and email of the Zambian representative. Registration itself is a criminal matter: processing without it is an offence carrying up to five years in prison.

Section 70(1) of the Data Protection Act, 2021 is a flat storage mandate. Section 70(2) gives the Minister a power to name categories of personal data that may be stored outside Zambia — that power has never been used, so no category is currently released. Section 70(3) then removes even that possibility for sensitive personal data. The regulator's registration guideline is explicit about how wide 'storing data outside Zambia' is: it covers 'an off-site data recovery site outside Zambia', 'a cloud-based system which stores data outside Zambia', and 'any other as long as the data is stored outside Zambia'. The same guideline tells applicants that if they answer yes, 'you will need to apply for a separate authorization to store personal data outside of Zambia'. There is a second, overlapping layer. The Cyber Security Act, 2025 requires a controller to host 'critical information or critical information infrastructure within the Republic', and lets the Zambia Cyber Security Agency permit hosting abroad case by case. The critical sectors it names are defence and security, the public sector, banking and finance, health, transport, pensions and insurance, information and communications technology, energy, education and mining. That duty only attaches once the Agency designates specific information as critical by notice in the Gazette. No such designation was found on any government source as at 18 August 2026, which means this layer is armed but not yet fired. Two sectors add further texture. In payments, no data location rule was found, but the Bank of Zambia now requires electronic money institutions to give it real-time read-only access to their platforms. In telecoms, the subscriber and device registers must be kept on the operator's own network with an uninterrupted link to the regulator's central register in Zambia. In health research, exporting human biological samples needs prior approval from the National Health Research Authority under a material transfer agreement that also governs access to the data generated.

Section 71 of the Data Protection Act, 2021 sets out the routes for personal data other than the categories released by the Minister under section 70(2). Route one: the data subject consents and either the transfer is made under standard contracts or intra-group schemes approved by the Data Protection Commissioner, or the Minister has prescribed that transfers outside Zambia are permissible. Route two: the Commissioner approves a particular transfer or set of transfers as permissible due to a situation of necessity. Section 71(4) adds narrow escape hatches — emergencies involving health or emergency services, explicit consent for sensitive personal data, and transfers to an international organisation or country the Commissioner is satisfied about. Section 71(6) then adds an ongoing duty: a controller relying on a standard contract must certify and periodically report to the Commissioner that the contract is being honoured, and must carry liability for harm caused by the recipient's non-compliance. The critical operational fact is that the lists are empty. As at 18 August 2026 the Commission's own resources page lists eleven documents — the Act, the 2021 registration regulations, registration forms and guides, a code of conduct, a breach management guide and a records guide. There is no approved set of standard contractual clauses, no adequacy list, and no cross-border transfer guideline. Separately, storing data abroad is treated by the regulator as needing its own authorisation over and above any transfer approval, and section 81(2) of the Act makes the controller pay the cost of auditing any foreign server it has been allowed to use.

The Office of the Data Protection Commissioner is established by section 4 of the Data Protection Act, 2021 inside the ministry responsible for communications, which is the Ministry of Technology and Science. The Commission's own team page names Likando Luywa as Data Commissioner. Registration is genuinely operating: there is an online portal, a manual route by email, and a published fee table running from about 67 kwacha to apply and 667 kwacha for a certificate for an individual or micro organisation, up to 400 kwacha to apply and 4,000 kwacha for a certificate for a large organisation or a data processor. At the Bank of Zambia mid rate of about 18.74 kwacha to the United States dollar on 18 August 2026, the largest of those is roughly 215 dollars. Certificates last twelve months and must be renewed. Against that, the signs of an immature regulator are hard to miss: the Audit Guidelines page and the Other Guidelines page both still display Latin placeholder text, the Team page still lists a dummy second member, the only press release on the site opens to an empty body, and the resources have download counts in the low hundreds. Enforcement is also not the Commission's alone. Most of the Act's teeth are criminal offences prosecuted through the courts, individuals can sue for compensation, and three other regulators are active in adjacent space: the Zambia Information and Communications Technology Authority for telecoms, the Zambia Cyber Security Agency created in 2025 for cyber security, and the Bank of Zambia for payments, which issued a dated and deadlined data access order in July 2025.

Section 51(1) of the Data Protection Act, 2021 says a controller and processor 'shall keep personal information for as long as that personal information is used for the specific purpose for which the personal information was collected and for as long as the personal information is relevant for that purpose and for a period of at least one year thereafter or other period that may be prescribed'. That is a mandatory minimum, not a maximum, and no shorter period has been prescribed. Pulling the other way, section 12(1)(e) requires data to be 'stored in a form which permits identification of data subjects for no longer than is necessary', and section 60 gives an enforceable right to erasure without undue delay once the data is no longer needed, once consent is withdrawn, or once processing is found unlawful. Section 51(2) adds a separate record-keeping duty covering the purpose of collection and the third parties data was disclosed to and when. Zambia gives no statutory tie-breaker between the one-year floor and the erasure right. The practical reading is that the specific one-year rule in section 51 beats the general principle, so an erasure request received inside that year should be met by restricting and quarantining the data rather than destroying it — and that reading has not been tested by a Zambian court. In telecoms, regulation 15 of the 2011 device registration regulations as amended in January 2026 requires an operator to keep the information in its equipment identification register for three years after the last use of the device. Longer floors also exist in Zambian tax and company law, which we did not verify for this record.

Section 49(1) of the Data Protection Act, 2021 requires a data controller to notify the Data Protection Commissioner 'within twenty-four hours of any security breach affecting personal data processed'. There is no harm threshold and no risk filter — on the face of the text every security breach affecting personal data is reportable. Section 49(2) puts a processor on an 'as soon as practicable' duty to its controller, and section 49(3) requires notice to the affected individual as soon as practicable. The Commission publishes a guide on management of data security breaches and hosts an online breach report form. The second clock comes from section 17 of the Cyber Security Act, 2025: a controller of critical information must immediately notify the Zambia Cyber Security Agency of a perceived or actual incident, then submit a preliminary written incident report within twelve hours, then a detailed report once the incident is resolved, plus status reports at intervals the Agency sets. Failure carries a fine of up to five hundred thousand penalty units or five years in prison. The twelve-hour duty only bites on organisations whose information has been designated critical by Gazette notice, and no such designation was found as at 18 August 2026. The overlap is the operational danger: an incident at a bank or hospital could in principle trigger a twelve-hour cyber report and a twenty-four hour privacy report to two different regulators with two different forms.

Trap one is section 51 against sections 12(1)(e) and 60, described in the retention answer. Trap two is section 48: 'a data controller and data processor shall appoint a data protection officer', with the manner of appointment left to guidelines. Unlike Europe there is no trigger based on scale, sensitivity or public authority status. Trap three is section 81: the Commissioner or an independent licensed data auditor audits the policies and processing of a data controller annually, and section 81(2) puts the cost of auditing an authorised foreign server on the controller. Data auditors must themselves be licensed under Part VI. Trap four is the penalty structure. A body corporate that breaches the processing principles faces a fine of up to one hundred million penalty units or two percent of the previous year's annual turnover, whichever is higher; at forty ngwee per penalty unit that fixed cap is forty million kwacha, roughly 2.1 million United States dollars. A natural person faces up to one million penalty units or five years in prison. Processing without registration carries up to five hundred thousand penalty units or five years. Unlawfully disclosing sensitive personal data carries up to two hundred thousand penalty units or two years. Section 76 makes a director, manager, shareholder or partner personally liable where the offence was committed with their knowledge, consent or connivance, and section 75 lets a court forfeit the medium holding the data and ban a convicted person from managing any processing at all. Trap five is section 17 read with the Constitution's definition of a child, which is a person below eighteen: parental or guardian consent is required, and the controller must 'incorporate appropriate mechanisms for age verification and parental consent'. A sixth, quieter trap: mobile lines now require biometric data. The January 2026 amendment to the device registration regulations requires operators to submit subscriber biometric data to the telecoms regulator, and makes a parent or guardian the registered subscriber for any line used by a child until that child turns eighteen.

Switch one, the liberalising one: the Minister may prescribe categories of personal data that may be stored outside Zambia. This power has existed since the Act commenced on 1 April 2021 and has never been used. A single statutory instrument could release most ordinary business data from the storage mandate overnight. Switch two, also liberalising: the Data Protection Commissioner may approve standard contracts and intra-group schemes. None have been approved or published, which is why the main legal route out of the country is currently closed. Publication of an approved set would move Zambia from case-by-case approval to something closer to a paperwork regime. Switch three, the tightening one: the Zambia Cyber Security Agency may, by notice in the Gazette, designate information or infrastructure in eleven critical sectors as critical. From the date of designation, the controller has thirty days to register with the Agency, must host that information inside Zambia unless separately authorised, must appoint an information technology auditor annually, and falls under the twelve-hour incident report. No designation notice was found on any government source as at 18 August 2026. Also worth watching: the Ministry of Technology and Science has run a public call for comments on the review of the earlier cyber security legislation, and the new Cyber Security Act, 2025 and Cyber Crimes Act, 2025 both need implementing regulations that had not appeared by August 2026. Because a single notice can change the storage picture in either direction, this record is set to refresh every sixty days.