On 23 March 2021, the Zambian Parliament enacted the Data Protection Act No. 3 of 2021. The Act is intended to provide for the lawful, fair, and transparent processing of personal information. The Act makes provision for the following:
- The establishment of the Office of the Data Protection Commissioner (DPC) as the regulatory authority for data protection;
- Principles for the processing of personal data, including providing the circumstances under which personal data and sensitive personal data may be processed by a data controller;
- Regulation of data controllers and data processors, including requiring registration with the DPC and setting out their duties and responsibilities;
- The rights of the data subject, such as to obtain confirmation of whether their personal data has been processed by a data controller and to rectification and erasure of personal data;
- Regulation of the transfer of personal data outside the country.
The introduction of Zambia’s Data Protection Act aims to reinforce the right to privacy which is enshrined in Article 17 of the Zambian Constitution and to regulate the use, collection, and storage of personal data in the country.
The Data Protection Act can be accessed here.
Please note: The information contained in this note is for general guidance on matters of interest and does not constitute legal advice. For any enquiries, please contact us at [email protected].