Zambia Data Protection & Privacy Regulation

Separately, the Bank of Zambia's own June 2026 position paper on Open Finance proposes a phased move toward mandatory data-sharing arrangements between financial institutions and mobile-money operators, noting that such sharing currently relies on bilateral agreements rather than a standardised framework, and that any mandatory regime should be contingent on strong data-protection systems being in place.

Other Developments

Reported enforcement penalty figures for the Data Protection Act are not fully reconciled across sources. Secondary legal commentary describes a corporate penalty of up to 100 million penalty units or 2 percent of annual turnover, whichever is higher, for breaches of the Act's principles, alongside a separately reported penalty of up to 40 million Kwacha or 2 percent of turnover for collecting personal information without consent, and a further reported default penalty of up to 120,000 Kwacha for an unspecified offence. These figures differ in scale and could not be reconciled against the Act's own gazetted text, so the precise penalty attaching to a given type of breach remains unconfirmed.

Cross-Monitor Connections

The Bank of Zambia's proposed phased move toward mandatory open-finance data-sharing is a development of direct interest to payments-market monitoring, since any mandatory data-sharing regime between banks and mobile-money operators would directly affect the operational and technical arrangements payment service providers must build, a question that sits on the payments side of the same policy proposal that, from a data-protection perspective, is framed around the adequacy of underlying data-protection safeguards.

Outlook

The principal matter to track is reconciliation: whether the Office of the Data Protection Commissioner's reported full operational status, and the differing penalty figures reported across secondary legal commentary, can be confirmed against the Data Protection Act's own gazetted text or a primary statement from the Commissioner's office. Separately, the Bank of Zambia's open-finance proposal remains at the position-paper stage, contingent on stronger data-protection systems being demonstrated before any mandatory data-sharing requirement would be introduced, so no immediate compliance obligation currently follows from it.

1 earlier update not shown here.

Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Zambia's Office of the Data Protection Commissioner (ODPC) is understood to have been fully operational since April 2025, correcting a prior baseline position that had treated the authority's institutional status as unconfirmed. A mandatory controller/processor registration deadline of 30 April 2025 has passed, and a Commissioner has held the post since June 2023. The same reporting corroborates a penalty regime for non-registration of a ZMW 200,000 fine and/or up to five years' imprisonment. Separately, an earlier framing that treated the Zambia Information and Communications Technology Authority (ZICTA) as holding interim or adjacent data-protection oversight competence has been flagged as unsupported by any retrievable source and is now held for review rather than treated as established fact.

Other Developments

Zambia's Data Protection Act, 2021 establishes the Office of the Data Protection Commissioner, a controller-registration regime, and statutory data-subject rights. Its subsidiary Registration and Licensing Regulations, 2021 were issued on 14 May 2021 under section 82 of the Act. Controllers and processors must apply to the Commissioner for a registration certificate, and the Commissioner registers controllers or processors only within the categories set out in section 3(1) of the Regulations. Data-audit service providers must separately apply for a licence under section 14(1).

The Act regulates the collection and processing of personal data of data subjects in Zambia at a general level. It also provides general rights of data subjects in relation to personal data held by controllers operating in Zambia, though granular access-request mechanics were not independently verified this cycle. Controllers are understood to be required to notify the Commissioner of a security breach within 24 hours under section 49, with corresponding data-subject notification duties. Controllers and processors are also understood to be required to appoint a Data Protection Officer under section 48(1)-(2) of the Act. Separately, controllers and processors are understood to be required to store personal data on a server or data centre located in Zambia under section 70 of the Act, with localisation of sensitive personal data treated as effectively absolute. They may transfer personal data outside Zambia only where conditions under section 71 are met, including data-subject consent and Commissioner approval or ministerial prescription. The Act also exempts processing from the general personal-data rules for purposes including maintenance of public order and national security, at a general level.

Cross-Monitor Connections

A secondary source encountered during this cycle's review discusses Zambia's regulatory landscape through an AI-regulation framing that is distinct from the data-protection profiling and automated-decision-making angle tracked here; that material has been routed to the artificial-intelligence monitor rather than analysed further in this brief.

Outlook

Zambia's data-protection regime is assessed as tightening this cycle, reflecting the combined effect of the institutional-status correction and the newly substantiated statutory duties addressed above. Sectoral overlays, adtech and commercial-privacy provisions, and protections for children and vulnerable groups remain without retrievable material this cycle and are carried forward as open gaps rather than treated as settled absence. The ZICTA-as-authority question remains unresolved and is held for further review.

Separately, the Bank of Zambia's June 2026 position paper on Open Finance proposes a phased move toward mandatory data-sharing between financial institutions and mobile-money operators, currently conducted via bilateral agreements, explicitly conditioning any such mandatory regime on the strength of Zambia's data-protection systems.

Outlook

The principal open item for Zambia's data-protection regulatory status is confirmation of the Data Protection Act's actual penalty schedule against its own gazetted text, given the inconsistent figures currently reported across secondary legal commentary. The Bank of Zambia's open-finance data-sharing proposal remains at the position-paper stage and is not yet a compliance obligation, but it signals that the maturity of the data-protection enforcement regime, including the Commissioner's registration drive, is being treated by at least one other regulator as a precondition for further sectoral reform.

1 earlier update not shown here.

Standing brief · as of 25 August 2026

Regulatory Status

Zambia's Office of the Data Protection Commissioner (ODPC) is understood to have been fully operational since April 2025, with a mandatory controller/processor registration deadline of 30 April 2025 having passed and a Commissioner in post since June 2023. An earlier framing that treated the Zambia Information and Communications Technology Authority (ZICTA) as holding interim or adjacent data-protection oversight competence has been flagged as unsupported by any retrievable source and is held for further review. Controllers and processors also face breach-notification, DPO-appointment, data-localisation and cross-border transfer duties under sections 49, 48, 70 and 71 of the Act, each corroborated this cycle after a prior baseline had recorded these areas as total gaps. The Data Protection Commissioner is understood to have authority to register data controllers and processors and to license data auditors under the Registration and Licensing Regulations, 2021, with failure to register punishable by a fine of ZMW 200,000 and/or up to five years' imprisonment.

Outlook

Zambia's regulatory direction is assessed as tightening, with institutional-maturity and core statutory-duty findings corrected upward this cycle. Sectoral, adtech and children's-data protections remain largely unaddressed, and the ZICTA-as-authority framing is held for further review rather than treated as settled.