Skip to content
DPO360

Data protection in Zambia.

The Data Protection Act, 2021 (No. 3 of 2021) came into operation on 1 April 2021. It establishes the Office of the Data Protection Commissioner, requires registration, and gives data controllers just 24 hours to report a security breach.

Get started Check your readiness
In force
April 2021
Regulator
Data Protection Commissioner
Breach deadline
24 hours

Supported via Kenya Hub

Lusaka

At a glance

Zambia, in seven lines.

Law
Data Protection Act, 2021 (No. 3 of 2021)
In force
1 April 2021
Regulator
Office of the Data Protection Commissioner
Registration
No one may act as a controller or processor without registering (section 19)
Data protection officer
A DPO must be appointed, under the Commissioner's guidelines (section 48)
Breach notification
Controllers: within 24 hours to the Commissioner (section 49). Data subjects: as soon as practicable
Penalties
Corporate bodies: greater of 100 million penalty units or 2% of annual turnover. Individuals: up to 1 million penalty units and/or 5 years

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Key obligations

What the law asks of you.

Four obligations organisations in Zambia meet first, and where we help with each.

Register before you process

No one may act as a data controller or processor without registering. Operating unregistered is an offence, with a fine of up to 500,000 penalty units and/or up to five years' imprisonment.

DPO360 helps with

Registration and licensing filings with national data protection authorities

Appoint a Data Protection Officer

Data controllers appoint a DPO under the Commissioner's guidelines.

DPO360 helps with

Formal DPO appointment and mandate definition, where permitted by law

Report breaches within 24 hours

A data controller notifies the Commissioner within 24 hours. Processors tell the controller, and data subjects are told, as soon as practicable.

DPO360 helps with

Incident and breach logging, escalation and regulator notification

Impact assessments and auditors

The Act provides for data protection impact assessments and for licensed data auditors.

DPO360 helps with

Data Protection Impact Assessments (DPIAs) for new or high-risk processing

How the framework came together

From the law to the regulator.

  1. 23 March 2021

    The Act is passed

    The Data Protection Act, 2021 is assented to.

  2. 1 April 2021

    The Act commences

    It comes into operation by commencement order. The first Data Protection Commissioner is appointed in June 2023.

  3. April 2025

    The Office is fully operational

    The Office of the Data Protection Commissioner opens online registration, with registration required by 30 April 2025.

Office of the Data Protection Commissioner logo

Regulatory authority

Office of the Data Protection Commissioner

Established in the ministry responsible for communications and responsible for regulating data protection and privacy in Zambia.

Mr. Likando Luywa, Data Protection Commissioner

What the regulator does

  • Keeps the register

    Registers data controllers and processors and licenses data auditors.

  • Receives breach notifications

    Security breaches are notified within 24 hours.

  • Enforces the Act

    Enforces the Act and may compound certain offences.

Penalties

What non-compliance can cost.

Corporate bodies

2%

of annual turnover, or 100M penalty units, whichever is higher

Breaching the principles and rules on processing personal data carries a fine of up to 100 million penalty units or 2% of annual turnover of the preceding financial year, whichever is higher.

Individuals

5 yrs

up to, imprisonment for individuals

Individuals face a fine of up to 1 million penalty units and/or up to five years' imprisonment. The Commissioner can also compound certain offences.

Readiness check

Where do you stand?

Tick what is already in place. A quick read on where you stand in Zambia, for orientation only.

0/6

Plenty to tighten.

A short scoping call will map the gaps and the order to close them.

Close the gaps with us

Compare

Eight countries at a glance.

Tap a country to highlight its column. Scroll sideways for the rest.

LawProtection of Personal Information Act (POPIA)Data Protection Act, 2019Nigeria Data Protection Act (NDPA), 2023Data Protection and Privacy Act, 2019Personal Data Protection Act, 2022Law No. 058/2021Data Protection Act, 2021Data Protection Act, 2024
In forceJuly 2021 (most provisions from July 2020)November 2019June 2023May 2019 (regulations March 2021)May 2023October 2021 (full compliance October 2023)April 2021June 2024
RegulatorInformation RegulatorOffice of the Data Protection Commissioner (ODPC)Nigeria Data Protection Commission (NDPC)Personal Data Protection Office (PDPO)Personal Data Protection Commission (PDPC)National Cyber Security Authority (NCSA)Office of the Data Protection CommissionerMalawi Communications Regulatory Authority (MACRA)
RegistrationRegister your Information Officer with the RegulatorMandatory above thresholds, and in certain sectors, with the ODPCControllers and processors of major importance register with the NDPCEvery data collector, processor and controller registers with the PDPOCollectors and processors register with the PDPCControllers and processors register with the NCSANo one may act as a controller or processor without registeringControllers and processors of significant importance register with MACRA
Data protection officerInformation Officer required for every organisationMay be designated; relevant for public bodies, large-scale monitoring and sensitive dataMandatory for controllers of major importanceA DPO must be designated by the head of the institutionA DPO must be appointedRequired in certain cases (large-scale monitoring or sensitive data)A DPO must be appointed, under the Commissioner's guidelinesRequired for public authorities, and for large-scale monitoring or sensitive data
Breach notificationAs soon as reasonably possible, to the Regulator and data subjectsWithin 72 hours to the ODPC; data subjects within a reasonably practical periodWithin 72 hours to the NDPC; data subjects immediately where high riskImmediately, to the PDPOPromptly, to the PDPCWithin 48 hours to the NCSAWithin 24 hours to the Commissioner; data subjects as soon as practicableWithin 72 hours to MACRA
PenaltiesAdministrative fines up to ZAR 10 million; up to 10 years' imprisonment for listed offencesUp to KES 5 million or 1% of annual turnover, whichever is lower; offences: up to KES 3 million and/or 10 yearsMajor importance: greater of NGN 10 million or 2% of annual gross revenue; others: greater of NGN 2 million or 2%Up to about UGX 4.8 million and/or 10 years for listed offencesPenalty notices up to TZS 100 million; companies up to TZS 5 billion; individuals up to TZS 20 million and/or 10 yearsAdministrative fines of RWF 2 to 5 million or 1% of global turnover; corporate criminal fines of 5% of annual turnoverCorporate bodies: greater of 100 million penalty units or 2% of annual turnover; individuals up to 1 million penalty units and/or 5 yearsAdministrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to 5 years
Open briefing →Open briefing →Open briefing →Open briefing →Open briefing →Open briefing →Open briefing →

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Reviewed October 2026 against: Data Protection Act, 2021 (sections 18, 19, 48, 49 and 73 to 74) and the Data Protection (Registration and Licensing) Regulations, 2021.

Additional resources

Read the source documents.

Data Protection Act 2021Legislation

Supported through

Kenya Hub

East, Central & Southern Africa

DPO360 in Zambia

How we support organisations in Zambia.

Zambia is supported through our Kenya hub, which covers East, Central & Southern Africa, with delivery coordinated from our Nairobi headquarters.

  • Registration and licensing filings with the national authority
  • Breach logging, escalation and regulator notification
  • Consent, policy and records-of-processing frameworks
  • Data mapping, including where data is processed
  • Data subject access request management
  • A standing DPO appointment, with DPO-as-a-Service

2nd Floor 90 JGO, James Gichuru Road, Lavington

P.O Box 40583-00100 Nairobi, Kenya

+254735360360 | +447394407463

Ready to Make Privacy Your Advantage?

Speak to our team about compliance in Zambia and beyond.

Book a consultationDPO-as-a-Service