--- title: "Zambia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/zambia/ source_html: /jurisdictions/zambia/index.html description: "Zambia data protection and privacy regulation: 10 categories, 10 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-04T02:23:31Z content_sha256: 72589a5ad315afd15c274e65022d946ed0f317fb1d8c887979d1396ca887de0a generator: "fe-fleet/md-twin@1.0" --- # Zambia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: artificial-intelligence Last updated 2026-10-25 · 10 categories · 10 claims · 27 sources in the cumulative register Download report (PDF) Expand all Zambia's Office of the Data Protection Commissioner (ODPC) is understood to have been fully operational since April 2025, correcting a prior baseline position that had treated the authority's institutional status as unconfirmed. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Enforcement & Redress (6 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ZAMBIA)[Build Report](/reports/?j=ZAMBIA)[Compare](/compare/?j=ZAMBIA) Framework posture In transition 6 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Zambia Information and Communications Technology Authority (ZICTA) — interim/adjacent Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 6 / 10 modules assessed 0 Confirmed · 5 Probable · 1 Uncertain · 4 Not yet assessed 10 Categories 1 Red categories 57 Sub-modules 10 Claims 2 Tier-1 sources Traffic-light mix 5 amber 1 red 4 n/a (sums to 10 rendered categories; click to filter) 1 category flagged red ## Jurisdiction brief Jurisdiction lead brief 993 Full executive summary 527 ###### Latest update · 25 October 2026 #### Lead Signal Zambia's Data Protection Act, 2021 regime is reported to have moved into an active enforcement posture, with secondary commentary indicating that the Office of the Data Protection Commissioner became fully operational and launched a registration and enforcement drive, with Commissioner Likando Luywa understood to have been in post since June 2023. A registration deadline of 30 April 2025 for data controllers and processors is reported to have passed, with non-registration framed as a criminal offence carrying a fine of ZMW 200,000 and, or, imprisonment of up to five years. These findings rest on trade-press and law-firm secondary commentary rather than a primary statement from the Commissioner's own office confirming institutional capacity or independence from the Zambia Information and Communications Technology Authority, so they are held at a qualified rather than assertive level of confidence. Separately, the Bank of Zambia's own June 2026 position paper on Open Finance proposes a phased move toward mandatory data-sharing arrangements between financial institutions and mobile-money operators, noting that such sharing currently relies on bilateral agreements rather than a standardised framework, and that any mandatory regime should be contingent on strong data-protection systems being in place. #### Other Developments Reported enforcement penalty figures for the Data Protection Act are not fully reconciled across sources. Secondary legal commentary describes a corporate penalty of up to 100 million penalty units or 2 percent of annual turnover, whichever is higher, for breaches of the Act's principles, alongside a separately reported penalty of up to 40 million Kwacha or 2 percent of turnover for collecting personal information without consent, and a further reported default penalty of up to 120,000 Kwacha for an unspecified offence. These figures differ in scale and could not be reconciled against the Act's own gazetted text, so the precise penalty attaching to a given type of breach remains unconfirmed. #### Cross-Monitor Connections The Bank of Zambia's proposed phased move toward mandatory open-finance data-sharing is a development of direct interest to payments-market monitoring, since any mandatory data-sharing regime between banks and mobile-money operators would directly affect the operational and technical arrangements payment service providers must build, a question that sits on the payments side of the same policy proposal that, from a data-protection perspective, is framed around the adequacy of underlying data-protection safeguards. #### Outlook The principal matter to track is reconciliation: whether the Office of the Data Protection Commissioner's reported full operational status, and the differing penalty figures reported across secondary legal commentary, can be confirmed against the Data Protection Act's own gazetted text or a primary statement from the Commissioner's office. Separately, the Bank of Zambia's open-finance proposal remains at the position-paper stage, contingent on stronger data-protection systems being demonstrated before any mandatory data-sharing requirement would be introduced, so no immediate compliance obligation currently follows from it. 1 earlier update not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Zambia's Office of the Data Protection Commissioner (ODPC) is understood to have been fully operational since April 2025, correcting a prior baseline position that had treated the authority's institutional status as unconfirmed. A mandatory controller/processor registration deadline of 30 April 2025 has passed, and a Commissioner has held the post since June 2023. The same reporting corroborates a penalty regime for non-registration of a ZMW 200,000 fine and/or up to five years' imprisonment. Separately, an earlier framing that treated the Zambia Information and Communications Technology Authority (ZICTA) as holding interim or adjacent data-protection oversight competence has been flagged as unsupported by any retrievable source and is now held for review rather than treated as established fact. #### Other Developments Zambia's Data Protection Act, 2021 establishes the Office of the Data Protection Commissioner, a controller-registration regime, and statutory data-subject rights. Its subsidiary Registration and Licensing Regulations, 2021 were issued on 14 May 2021 under section 82 of the Act. Controllers and processors must apply to the Commissioner for a registration certificate, and the Commissioner registers controllers or processors only within the categories set out in section 3(1) of the Regulations. Data-audit service providers must separately apply for a licence under section 14(1). The Act regulates the collection and processing of personal data of data subjects in Zambia at a general level. It also provides general rights of data subjects in relation to personal data held by controllers operating in Zambia, though granular access-request mechanics were not independently verified this cycle. Controllers are understood to be required to notify the Commissioner of a security breach within 24 hours under section 49, with corresponding data-subject notification duties. Controllers and processors are also understood to be required to appoint a Data Protection Officer under section 48(1)-(2) of the Act. Separately, controllers and processors are understood to be required to store personal data on a server or data centre located in Zambia under section 70 of the Act, with localisation of sensitive personal data treated as effectively absolute. They may transfer personal data outside Zambia only where conditions under section 71 are met, including data-subject consent and Commissioner approval or ministerial prescription. The Act also exempts processing from the general personal-data rules for purposes including maintenance of public order and national security, at a general level. #### Cross-Monitor Connections A secondary source encountered during this cycle's review discusses Zambia's regulatory landscape through an AI-regulation framing that is distinct from the data-protection profiling and automated-decision-making angle tracked here; that material has been routed to the artificial-intelligence monitor rather than analysed further in this brief. #### Outlook Zambia's data-protection regime is assessed as tightening this cycle, reflecting the combined effect of the institutional-status correction and the newly substantiated statutory duties addressed above. Sectoral overlays, adtech and commercial-privacy provisions, and protections for children and vulnerable groups remain without retrievable material this cycle and are carried forward as open gaps rather than treated as settled absence. The ZICTA-as-authority question remains unresolved and is held for further review. Read full brief · 993 words ###### Latest update · 25 October 2026 #### Regulatory Status Zambia's data-protection regime, built on the Data Protection Act No. 3 of 2021, is reported to have entered an active enforcement phase. The Office of the Data Protection Commissioner is described in trade press as fully operational, pursuing a registration and enforcement drive, with Commissioner Likando Luywa understood to have held the post since June 2023. A registration deadline of 30 April 2025 for data controllers and processors is reported to have passed, with non-registration framed as a criminal offence carrying a fine of ZMW 200,000 and, or, imprisonment of up to five years. The Act's substantive penalty architecture for breaches beyond non-registration is less settled across the secondary sources reviewed: reported figures range from up to 100 million penalty units or 2 percent of turnover for principles breaches, to a separately reported 40 million Kwacha tier for consent-related breaches, to a reported default penalty of 120,000 Kwacha for an unspecified offence, with these figures not yet reconciled against the Act's own gazetted text. Separately, the Bank of Zambia's June 2026 position paper on Open Finance proposes a phased move toward mandatory data-sharing between financial institutions and mobile-money operators, currently conducted via bilateral agreements, explicitly conditioning any such mandatory regime on the strength of Zambia's data-protection systems. #### Outlook The principal open item for Zambia's data-protection regulatory status is confirmation of the Data Protection Act's actual penalty schedule against its own gazetted text, given the inconsistent figures currently reported across secondary legal commentary. The Bank of Zambia's open-finance data-sharing proposal remains at the position-paper stage and is not yet a compliance obligation, but it signals that the maturity of the data-protection enforcement regime, including the Commissioner's registration drive, is being treated by at least one other regulator as a precondition for further sectoral reform. 1 earlier update not shown here. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Zambia's Office of the Data Protection Commissioner (ODPC) is understood to have been fully operational since April 2025, with a mandatory controller/processor registration deadline of 30 April 2025 having passed and a Commissioner in post since June 2023. An earlier framing that treated the Zambia Information and Communications Technology Authority (ZICTA) as holding interim or adjacent data-protection oversight competence has been flagged as unsupported by any retrievable source and is held for further review. Controllers and processors also face breach-notification, DPO-appointment, data-localisation and cross-border transfer duties under sections 49, 48, 70 and 71 of the Act, each corroborated this cycle after a prior baseline had recorded these areas as total gaps. The Data Protection Commissioner is understood to have authority to register data controllers and processors and to license data auditors under the Registration and Licensing Regulations, 2021, with failure to register punishable by a fine of ZMW 200,000 and/or up to five years' imprisonment. #### Outlook Zambia's regulatory direction is assessed as tightening, with institutional-maturity and core statutory-duty findings corrected upward this cycle. Sectoral, adtech and children's-data protections remain largely unaddressed, and the ZICTA-as-authority framing is held for further review rather than treated as settled. Read full brief · 527 words Key regulatory facts for Zambia Regulatory Dimension Zambia Standing Position Jurisdiction Zambia (ZM) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 10 sourced findings) Regulator & Framework Statute is enacted and a registration regime is operative, but the dedicated Authority's independent operational status is unverified and flagged by the seed as pending. Lawful Processing & Special Data Only a general, high-level statutory purpose statement is evidenced; granular lawful-basis/consent/special-category text is unverified. Data Subject Rights Existence of a data-subject-rights framework is evidenced at a general level; procedural specifics (deadlines, portability mechanics) remain unverified gaps. Controller/Processor Duties One concrete accountability-adjacent duty (data-auditor licensing) is confirmed; the remaining six sub-modules are unverified gaps. Primary Instruments Cited ZICTA, OneTrust DataGuidance, OneTrust DataGuidance Last Confirmed / Updated 2026-10-25 (27 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Zambia: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Statute is enacted and a registration regime is operative, but the dedicated Authority's independent operational status is unverified and flagged by the seed as pending. Primary framework Data Protection Act, 2021 (Act No. 3 of 2021) Supervisory authority [Zambia Information and Communications Technology Authority (ZICTA) — interim/adjacent competence pending full Data Protection Authority operationalisation; Office of the Data Protection Commissioner is the statutory registration authority](https://www.zicta.zm/) Traffic-light rationale — Amber Statute is enacted and a registration regime is operative, but the dedicated Authority's independent operational status is unverified and flagged by the seed as pending. #### Sub-modules (5) #### Regulator And AuthorityAmber The Act contemplates a dedicated Authority/Commissioner; ZICTA holds interim/adjacent oversight competence pending full independent operationalisation. Claims (1): - The dedicated Data Protection Authority contemplated by Zambia's Data Protection Act, 2021 has not been confirmed as fully, independently operationalised as of this run's dispatch date; ZICTA holds interim/adjacent data-protection oversight competence in the meantime. #### Act And InstrumentsGreen Core instrument is the Data Protection Act, 2021 (Act No. 3 of 2021), supplemented by the Data Protection (Registration and Licensing) Regulations, 2021 (SI No. 58 of 2021) issued under section 82 of the Act. Claims (2): - The Data Protection Bill, 2020, enacted as the Data Protection Act, 2021, provides for the regulation of the collection and processing of personal data, the establishment of the Office of the Data Protection Commissioner, the registration of data controllers, and the rights of data subjects. - The Data Protection (Registration and Licensing) Regulations, 2021 (Statutory Instrument No. 58 of 2021) were issued on 14 May 2021 by the Minister of Transport and Communications under section 82 of the Data Protection Act No. 3 of 2021. #### Material ScopeRed No T1/T2 primary text on the Act's material-scope definitions (personal data, processing, controller/processor definitions) was retrievable via allowlisted hostnames in this run. Searches conducted: 'Data Protection Act 2021 Zambia full text sections'; 'sensitive personal data consent lawful basis Zambia'. Gap recorded rather than inferred. #### Territorial ScopeRed No accessible primary or secondary source confirmed the Act's extraterritorial/establishment-based application test. Gap recorded; searches as above yielded no citable material. #### Regulator Registration And FilingGreen The Registration and Licensing Regulations, 2021 require controllers/processors to obtain a certificate of registration from the Data Protection Commissioner, and require data auditors to be licensed. Claims (2): - Under Section 4 of the Data Protection (Registration and Licensing) Regulations, 2021, data controllers or data processors shall apply to the Data Protection Commissioner for a certificate of registration. - Section 3(1) of the Data Protection (Registration and Licensing) Regulations, 2021 stipulates that the Data Protection Commissioner shall register a data controller or a data processor only in specified categories set out in the Regulations. Zambia's principal data-protection instrument is the Data Protection Act, 2021 (Act No. 3 of 2021), which succeeded the Data Protection Bill, 2020 submitted to the National Assembly in December 2020. The Act establishes an Office of the Data Protection Commissioner and a registration regime for controllers/processors, implemented via the Data Protection (Registration and Licensing) Regulations, 2021 (SI No. 58 of 2021). Per the injected seed, the dedicated independent Data Protection Authority contemplated by the Act has not been fully operationalised; ZICTA holds interim/adjacent competence. Searches conducted: 'ZICTA Authority operationalisation 2026', 'Data Protection Commissioner appointed 2024/2025', 'Data Protection Act 2021 full text sections' — no T1 primary statute text or official gazette confirming full institutional stand-up was retrievable via the allowlisted hostnames; only secondary (T3) reporting and the ZICTA homepage were reachable. Periodic update · new data 2026-10-11 #### Regulator & Framework Zambia's data protection framework is anchored in the Data Protection Act, No. 3 of 2021, which was assented to on 23 March 2021 and came into operation on 1 April 2021 according to secondary sources corroborated against the National Assembly's own text of the Act. Section 4 of the Act establishes the Office of the Data Protection Commissioner as the primary regulatory authority, sitting within the ministry responsible for communications. Secondary legal commentary reports that the Office was reported as fully operational as of April 2025, more than four years after the Act's own commencement date, and that Zambia's first substantive Data Protection Commissioner was appointed in June 2023, roughly two years into that gap. This sequencing, a statute in force since 2021 but a regulator not reported as fully staffed and operational until 2025, is itself a material part of the regulatory-framework picture: it indicates a multi-year period during which the law existed on the books without an evidently functioning administrative body behind it. A central operational feature of the current framework is the registration regime administered by the Office. Data controllers and processors were required to register with the Office by 30 April 2025, with failure to do so constituting an offence carrying penalties reported as a fine of up to ZMW 200,000 and, or up to five years imprisonment. This registration duty functions as the practical gateway through which the Office identifies and tracks the population of entities subject to the Act, and the criminal penalty attached to non-registration signals that the Zambian regime treats registration as a core compliance obligation rather than an optional administrative step. It should be noted that no primary, Office-held source could be directly retrieved this cycle to independently confirm the April 2025 operational-status report or the precise registration figures; the claims above rest on secondary legal commentary rather than the Office's own publications. The Act's own text, retrieved directly from the National Assembly of Zambia's register, confirms the Act's assent and commencement dates but does not itself speak to the Office's later operational timeline, which is necessarily a post-enactment administrative development reported only in secondary sources. #### Outlook The principal open question for Zambia's regulatory framework is whether the Office of the Data Protection Commissioner's reported April 2025 operational status, and its administration of the registration regime, can be confirmed against the Office's own primary publications rather than secondary legal commentary alone. Given that the registration deadline of 30 April 2025 has now passed, the near-term signal to watch is whether the Office begins publishing its own guidance, registration statistics or decisions, which would allow the operational-framework picture built from secondary commentary this cycle to be corroborated or revised against a primary source. 1 earlier distinct update(s) Periodic update · new data 2026-09-29 #### Regulator & Framework Zambia's data-protection and cyber-law regulatory architecture has developed materially this cycle. The Office of the Data Protection Commissioner is understood to be fully operational, actively enforcing privacy and data protection compliance in Zambia, following the June 2023 appointment of Zambia's first Data Protection Commissioner. This operationalisation is corroborated by secondary law-firm commentary, though it has not been independently confirmed against a primary ODPC publication this cycle. Separately, Zambia has enacted a structural split of its combined 2021 cyber statute. The Cyber Security Act, 2025 (Act No. 3 of 2025) repeals and replaces the Cyber Security and Cyber Crimes Act, 2021, and establishes the Zambia Cyber Security Agency, separating regulatory cyber-security functions from criminal-law cybercrime functions. The companion Cyber Crimes Act, 2025 (Act No. 4 of 2025) establishes cybercrime offences and online child-protection provisions that previously sat within the single combined 2021 Act. Both Acts are enacted but not yet effective: their commencement date is to be appointed by the Minister by statutory instrument, and that instrument had not been located as of this cycle. The practical effect is a bifurcated statutory architecture in which the regulatory (Cyber Security Act) and criminal (Cyber Crimes Act) functions now sit on separate instruments, both awaiting ministerial commencement, alongside an already-operational Data Protection Commissioner enforcing under the existing Data Protection Act, 2021. #### Outlook The ministerial statutory instrument appointing commencement dates for the Cyber Security Act, 2025 and the Cyber Crimes Act, 2025 is the key dated event to watch, expected in an estimated Q1 2027 window carrying a wide multi-year uncertainty band. Until that instrument is published, both Acts remain enacted but not yet effective. Sources and claims (5) - [ZICTA](https://www.zicta.zm/) — The dedicated Data Protection Authority contemplated by Zambia's Data Protection Act, 2021 has not been confirmed as fully, independently operationalised as of this run's dispatch date; ZICTA holds interim/adjacent data-protection oversight competence in the meantime. - [OneTrust DataGuidance](https://www.dataguidance.com/news/zambia-data-protection-and-electronic-communications) — The Data Protection Bill, 2020, enacted as the Data Protection Act, 2021, provides for the regulation of the collection and processing of personal data, the establishment of the Office of the Data Protection Commissioner, the registration of data controllers, and the rights of data subjects. - [OneTrust DataGuidance](https://www.dataguidance.com/news/zambia-data-protection-regulations-controllers-and) — The Data Protection (Registration and Licensing) Regulations, 2021 (Statutory Instrument No. 58 of 2021) were issued on 14 May 2021 by the Minister of Transport and Communications under section 82 of the Data Protection Act No. 3 of 2021. - [OneTrust DataGuidance](https://www.dataguidance.com/news/zambia-data-protection-regulations-controllers-and) — Under Section 4 of the Data Protection (Registration and Licensing) Regulations, 2021, data controllers or data processors shall apply to the Data Protection Commissioner for a certificate of registration. - [OneTrust DataGuidance](https://www.dataguidance.com/news/zambia-data-protection-regulations-controllers-and) — Section 3(1) of the Data Protection (Registration and Licensing) Regulations, 2021 stipulates that the Data Protection Commissioner shall register a data controller or a data processor only in specified categories set out in the Regulations. ### Zambia: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a general, high-level statutory purpose statement is evidenced; granular lawful-basis/consent/special-category text is unverified. Primary framework Data Protection Act, 2021 (Act No. 3 of 2021) Supervisory authority [Zambia Information and Communications Technology Authority (ZICTA) — interim/adjacent competence; Office of the Data Protection Commissioner](https://www.zicta.zm/) Traffic-light rationale — Red Only a general, high-level statutory purpose statement is evidenced; granular lawful-basis/consent/special-category text is unverified. D2 · Lawful Processing — Full Module Record 4 sub-modules · 64 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Zambia: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Existence of a data-subject-rights framework is evidenced at a general level; procedural specifics (deadlines, portability mechanics) remain unverified gaps. Primary framework Data Protection Act, 2021 (Act No. 3 of 2021) Supervisory authority [Office of the Data Protection Commissioner (Zambia); ZICTA interim/adjacent competence](https://www.zicta.zm/) Traffic-light rationale — Amber Existence of a data-subject-rights framework is evidenced at a general level; procedural specifics (deadlines, portability mechanics) remain unverified gaps. #### Sub-modules (5) #### Access RightAmber General right of data subjects is provided for in the Act; specific access-request procedure not confirmed against primary text. Claims (1): - The Data Protection Act, 2021 provides for rights of data subjects in relation to personal data held by data controllers operating in Zambia. #### Rectification And ErasureRed Not independently confirmed against accessible primary text in this run; gap recorded. #### Restriction And ObjectionRed Not independently confirmed against accessible primary text in this run; gap recorded. #### Data PortabilityRed Not independently confirmed against accessible primary text in this run; gap recorded. #### Deadlines And Response WindowsRed No statutory response-window figure was retrievable via allowlisted hostnames in this run; gap recorded. The enacted Act is reported to cover 'the rights of data subjects,' but the specific mechanics of access, rectification/erasure, restriction/objection, portability, and statutory response deadlines were not retrievable in accessible T1/T2 text during this run. Searches conducted: 'Zambia Data Protection Act breach notification data subject rights DPO summary'; 'Data Protection Act 2021 Zambia full text sections'. No periodic updates recorded in this cycle Sources and claims (1) - [OneTrust DataGuidance](https://www.dataguidance.com/news/zambia-data-protection-and-electronic-communications) — The Data Protection Act, 2021 provides for rights of data subjects in relation to personal data held by data controllers operating in Zambia. ### Zambia: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ One concrete accountability-adjacent duty (data-auditor licensing) is confirmed; the remaining six sub-modules are unverified gaps. Primary framework Data Protection Act, 2021 (Act No. 3 of 2021); Data Protection (Registration and Licensing) Regulations, 2021 (SI No. 58 of 2021) Supervisory authority [Office of the Data Protection Commissioner (Zambia); ZICTA interim/adjacent competence](https://www.zicta.zm/) Traffic-light rationale — Amber One concrete accountability-adjacent duty (data-auditor licensing) is confirmed; the remaining six sub-modules are unverified gaps. Periodic update · new data 2026-09-29 #### Controller/Processor Duties The Office of the Data Protection Commissioner is understood to have launched an online registration portal for data controllers and data processors, making registration mandatory for entities handling personal data in Zambia. This is reported as a new compliance mechanism introduced alongside the Commissioner's broader operationalisation, rather than as a change to the underlying substantive obligations set out in the Data Protection Act, 2021 itself. The registration requirement's practical scope, including whether exemptions exist for small-scale or non-commercial processors, was not established by the evidence available this cycle. What is reported is that registration through the portal is mandatory rather than voluntary, positioning it as a gateway compliance step that controllers and processors operating in Zambia must complete as a precondition of, or alongside, their ongoing data-handling activity. This development should be read as tightening the practical enforcement of existing controller and processor obligations rather than introducing new substantive duties: the registration portal is an administrative mechanism through which the Commissioner can identify and track the population of controllers and processors subject to the Data Protection Act, 2021, which in turn supports the enforcement and compliance-campaign activity reported separately. #### Outlook The ODPC's promised implementing regulations and guidelines specifying the registration portal's procedural detail were referenced in secondary commentary but not independently located or cited by instrument number this cycle. Watch for publication of those implementing regulations as the event that would clarify the registration requirement's full practical scope. D4 · Controller & Processor — Full Module Record 7 sub-modules · 63 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Zambia: D5 Cross-Border & Adequacy 6 sub-modules Not assessed ▾ No claims meet the evidentiary bar for this module in this run. Primary framework Data Protection Act, 2021 (Act No. 3 of 2021) — cross-border provisions not verified against primary text in this run Supervisory authority [Office of the Data Protection Commissioner (Zambia); ZICTA interim/adjacent competence](https://www.zicta.zm/) Traffic-light rationale — Not assessed No claims meet the evidentiary bar for this module in this run. #### Sub-modules (6) #### Transfer MechanismsRed No confirmed primary text; gap recorded. #### Adequacy ReceivedRed No adequacy decision received by Zambia from other regimes was identified. #### Adequacy GrantedRed No adequacy decision granted by Zambia to other regimes was identified. #### Sccs And BcrsRed No SCC/BCR-equivalent uptake or forms were identified. #### Transfer Impact AssessmentRed No TIA requirement was identified. #### Data LocalisationRed No localisation mandate (partial or absolute) was identified. No T1/T2 primary or secondary text confirming Zambia's cross-border transfer mechanisms (adequacy, SCC/BCR equivalents, derogations), any adequacy decisions received or granted, transfer-impact-assessment requirements, or data-localisation mandates was retrievable via allowlisted hostnames. Searches conducted: 'Data Protection Act 2021 cross-border transfer personal data section'; general Act full-text searches returned only registration/licensing secondary reporting. This module is emitted with an explicit gap rather than an inferred/fabricated transfer regime. No periodic updates recorded in this cycle ### Zambia: D6 Sectoral Watch 7 sub-modules Not assessed ▾ No sub-module met the evidentiary bar for a claim in this run; all seven are explicit gaps. Traffic-light rationale — Not assessed No sub-module met the evidentiary bar for a claim in this run; all seven are explicit gaps. #### Sub-modules (7) #### Financial Sector OverlayRed No confirmed overlay text; gap recorded. #### Health Sector OverlayRed No confirmed overlay text; gap recorded. #### Telecoms And EprivacyRed Title-level metadata only for the Cyber Security and Cyber Crimes Act, 2021 (Act No. 2 of 2021); no substantive overlay text confirmed, so no claim minted. #### Employment DataRed No confirmed overlay text; gap recorded. #### Credit And ScoringRed No confirmed overlay text; gap recorded. #### EducationRed No confirmed overlay text; gap recorded. #### InsuranceRed No confirmed overlay text; gap recorded. A separate Cyber Security and Cyber Crimes Act, 2021 (Act No. 2 of 2021) exists in Zambia alongside the Data Protection Act, but only title-level secondary metadata was retrievable, with no citable substantive overlay text confirming its interaction with the general DP regime; no claim was minted on that basis. No sector-specific overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) were retrievable via allowlisted hostnames. Searches conducted: 'Zambia Cyber Security and Cyber Crime Act 2021 data protection'; 'Data Protection Act 2021 sectoral overlay'. No periodic updates recorded in this cycle ### Zambia: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No claims meet the evidentiary bar for this module in this run. Traffic-light rationale — Not assessed No claims meet the evidentiary bar for this module in this run. #### Sub-modules (6) #### Cookies And TrackersRed No confirmed provision; gap recorded. #### Dark PatternsRed No confirmed provision; gap recorded. #### Opt Out SignalsRed No confirmed provision; gap recorded. #### Clean Rooms And DcrRed No confirmed provision; gap recorded. #### Cross Context AdvertisingRed No confirmed provision; gap recorded. #### Direct MarketingRed No confirmed provision; gap recorded. No T1/T2 or credible T3 material on cookie/tracker consent rules, dark-pattern prohibitions, opt-out signals, clean-room/DCR rules, cross-context advertising, or direct-marketing consent/suppression for Zambia was retrievable via allowlisted hostnames. This is an unaddressed area of Zambia's current framework as far as accessible sources show. ### Zambia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ One state-surveillance-carveout provision is confirmed at a general level; the remaining five sub-modules are unverified gaps. Primary framework Data Protection Act, 2021 (Act No. 3 of 2021) Supervisory authority [Office of the Data Protection Commissioner (Zambia); ZICTA interim/adjacent competence](https://www.zicta.zm/) Traffic-light rationale — Amber One state-surveillance-carveout provision is confirmed at a general level; the remaining five sub-modules are unverified gaps. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 68 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Zambia: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No claims meet the evidentiary bar for this module in this run. Traffic-light rationale — Not assessed No claims meet the evidentiary bar for this module in this run. #### Sub-modules (5) #### Age VerificationRed No confirmed provision; gap recorded. #### Parental ConsentRed No confirmed provision; gap recorded. #### Minor Profiling BansRed No confirmed provision; gap recorded. #### Education SettingsRed No confirmed provision; gap recorded. #### Dependent AdultsRed No confirmed provision; gap recorded. No T1/T2 material on age-of-consent thresholds, parental-consent mechanisms, minor-profiling bans, education-setting rules, or dependent-adult protections under Zambia's Act was retrievable via allowlisted hostnames in this run. No new data since the standing brief. 1 periodic run re-emitted it unchanged. ### Zambia: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A concrete regulatory power (registration/licensing) is confirmed, but broader enforcement maturity, penalties, and redress mechanisms are unverified gaps, compounded by unresolved institutional-operationalisation status. Primary framework Data Protection Act, 2021 (Act No. 3 of 2021); Data Protection (Registration and Licensing) Regulations, 2021 (SI No. 58 of 2021) Supervisory authority [Office of the Data Protection Commissioner (Zambia); ZICTA interim/adjacent competence](https://www.zicta.zm/) Traffic-light rationale — Amber A concrete regulatory power (registration/licensing) is confirmed, but broader enforcement maturity, penalties, and redress mechanisms are unverified gaps, compounded by unresolved institutional-operationalisation status. Periodic update · new data 2026-10-25 #### Enforcement & Redress Zambia's data-protection enforcement regime is reported to have become operationally active, with the Office of the Data Protection Commissioner described in trade press as fully operational and pursuing a registration and enforcement drive, with Commissioner Likando Luywa understood to have held the post since June 2023. A registration deadline of 30 April 2025 for data controllers and processors is reported to have passed; failure to register by that deadline is described as a criminal offence carrying a fine of ZMW 200,000, equivalent to approximately USD 7,186, and, or, imprisonment of up to five years. This registration-focused enforcement posture, criminalising a procedural failure to register rather than targeting a specific substantive data-handling violation, is consistent with an early-stage enforcement regime establishing baseline compliance across a population of controllers and processors before moving to substantive enforcement of processing obligations. Beyond registration enforcement, the penalty architecture for substantive breaches of the Act is less settled in the secondary sources reviewed. One source describes a corporate penalty of up to 100 million penalty units, or 2 percent of annual turnover for the preceding financial year, whichever is higher, for conviction on a breach of the Act's principles, with an individual facing up to 1 million penalty units and, or, up to five years' imprisonment. A separate source describes a materially different penalty tier applying specifically where personal information is collected without consent: a fine not exceeding 40 million Kwacha or 2 percent of annual turnover, whichever is higher, alongside a further default penalty, for an otherwise unspecified offence, of a fine not exceeding 120,000 Kwacha. These figures differ substantially in scale from one another, and neither source was cross-checked against the Act's own gazetted text, so which figure attaches to which category of breach, and whether both figures are in fact correct for different provisions, remains unresolved. This inconsistency across the secondary legal commentary reviewed is itself a notable feature of the current state of public understanding of Zambia's data-protection penalty regime: multiple law-firm and legal-publishing sources report different figures for what appear to be different types of offence under the same statute, without any setting out the full penalty schedule as the Act itself states it. #### Outlook Reconciling the Data Protection Act's penalty schedule against its own gazetted text, rather than relying on the secondary commentary reviewed, is the clearest outstanding item for Zambia's enforcement and redress landscape. Pending that reconciliation, controllers and processors operating in Zambia face reported registration-related criminal liability that appears comparatively well evidenced, alongside a substantive breach-penalty regime whose precise scale and structure remain genuinely uncertain across the available secondary sources. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Data Protection Act, No. 3 of 2021 establishes a tiered penalty structure that secondary legal commentary describes in some detail, though the precise figures vary somewhat in the drafting language across commentary sources reviewed this cycle. A general offence without a specified penalty is reported to carry a maximum fine of 300,000 penalty units or imprisonment of up to three years, or both. Unauthorised disclosure of sensitive personal data is reported to carry a lower ceiling, up to 200,000 penalty units or two years imprisonment, while processing personal data without having registered with the Office of the Data Protection Commissioner is reported to carry the highest individual-offence ceiling among those identified, up to 500,000 penalty units or five years imprisonment. Separately from these offence-specific figures, a corporate body found to have breached the Act's principles and rules on processing personal data is reported to face a fine of up to 100,000,000 penalty units or two percent of the preceding year's annual turnover, whichever is higher, a structure that mirrors the turnover-linked penalty architecture seen in several other modern data protection regimes internationally and signals that the statute contemplates materially larger financial exposure for corporate contraventions than the individual penalty-unit figures alone would suggest. Data subjects dissatisfied with how the Office resolves their complaint are reported to have a right of appeal to the High Court, to be lodged within 30 days of the Office's ruling, providing a judicial avenue distinct from the administrative complaints process itself. The most significant open finding in this module is a direct disagreement between secondary sources on the basic question of whether the Office has taken any enforcement action at all. One source reports that the regulator is not aware of any enforcement action having been taken, attributing the absence to the relative recency of the law. A separate, 2025-dated source describes enforcement as already in full swing since February 2025. These two characterisations cannot both be straightforwardly accurate as stated, and no primary, Office-held enforcement record was retrieved this cycle that would resolve the disagreement. This brief reports the disagreement itself as the finding, consistent with the evidentiary record available, rather than adopting either characterisation as the confirmed position. #### Outlook The resolution of the disputed enforcement-activity question is the single most consequential near-term development to watch in this module. Given that the Act has now been in force since 2021, the registration deadline has passed, and the tiered penalty structure, including the turnover-linked corporate fine, is already operative law, the absence of a confirmed enforcement record from a primary source represents a genuine evidentiary gap rather than a gap in the underlying law itself. Future primary publication by the Office, whether in the form of published decisions, enforcement statistics, or formal confirmation of an initial enforcement action, would materially sharpen the currently disputed picture. Periodic update · new data 2026-09-29 #### Enforcement & Redress The Office of the Data Protection Commissioner is understood to be fully operational and actively enforcing privacy and data protection compliance in Zambia. The Commissioner is reported to be initiating regulatory enforcement and public compliance campaigns intended to promote transparency, accountability and data security in the handling of personal data, consistent with the Commission's stated mandate of ensuring that handling of personal data adheres to the Data Protection Act, 2021 and best security practices. No specific sanction, fine, or named enforcement action against an individual controller or processor was identified this cycle; the enforcement signal at this stage is one of institutional operationalisation and public-facing compliance-campaign activity rather than adjudicated cases. This distinction matters for reading the enforcement posture accurately: an operational and campaigning regulator is a materially different enforcement environment from one that has begun issuing sanctions, and the evidence available this cycle supports only the former. The mandatory controller/processor registration portal, reported separately under controller/processor duties, functions as a complementary enforcement-support mechanism, allowing the Commissioner to identify the population against which compliance campaigns and any future enforcement action would be directed. #### Outlook Watch for the Commission's first published sanction or enforcement decision as the event that would mark a transition from campaign-and-registration-stage enforcement to adjudicated enforcement activity. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 69 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties