Data Protection Act No. 3 of 2021 (Zambia) compliance software
Zambia's Data Protection Act 2021 with the Data Protection (Registration and Licensing) Regulations, SI 58 of 2021: 89 controls across 12 domains, covering registration, the data protection officer, the 24-hour breach notice, in-country storage of sensitive personal data and the annual data audit.
- RegulatorOffice of the Data Protection Commissioner (Zambia)
- InstrumentsData Protection Act No. 3 of 2021; Data Protection (Registration and Licensing) Regulations, SI 58 of 2021
- Structure12 domains · 89 controls
- DeadlinesRegistration of controllers and processors due by 30 April 2025
- NotificationsPersonal data breach to the Commissioner within 24 hours · annual data audit
What Zambia DPA requires
Who it applies to
- Data controllers and data processors in Zambia, registered by category: individuals and micro, medium and large organisations
- Organisations holding sensitive personal data, including health data, which must keep it stored in Zambia
- Data auditors, who must be licensed under SI 58 of 2021 to offer data auditing services
- Owners of critical information infrastructure under the Cyber Security Act 2025, whose personal data duties sit alongside their cyber duties
The Data Protection Act No. 3 of 2021 was assented to on 23 March 2021 and is administered by the Office of the Data Protection Commissioner, which registers data controllers and processors and licenses data auditors. The Data Protection (Registration and Licensing) Regulations, Statutory Instrument No. 58 of 2021, set the registration categories by size, the application forms and the licensing of data auditing services. Registration of every controller and processor was due by 30 April 2025. GRCLens carries 89 assessable controls across 12 domains.
The Act asks more of organisations than most data protection laws in the region. Every controller and processor must appoint a data protection officer, and a personal data breach must be notified to the Commissioner within 24 hours. Personal data is to be processed and stored on a server or data centre in Zambia unless the Minister prescribes otherwise, and sensitive personal data, which includes health data, must stay in Zambia. Large-scale processing of sensitive data needs a data protection impact assessment, and processing is subject to an annual data audit by the Commissioner or a licensed data auditor.
Since May 2025 the Act has worked alongside the Cyber Security Act No. 3 of 2025, which requires owners of critical information infrastructure to host it in Zambia unless authorised, to commission an annual cyber audit and to file a preliminary incident report within 12 hours. A bank, mine or hospital designated as critical information infrastructure therefore runs two sets of clocks and two audits over largely the same systems, which is why GRCLens assesses them on one control model.
How GRCLens supports Zambia DPA
Zambia DPA runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
A 24-hour breach clock
Detection, the decision that a breach has occurred and the notice to the Commissioner are timed against the 24-hour limit, a third of the 72 hours allowed under the GDPR and many laws modelled on it.
Registration and the data protection officer
The registration certificate, its category and renewal, and the officer's appointment and reporting line are evidenced controls rather than a tick in a questionnaire.
Data residency as an assessable duty
Storage of personal and sensitive personal data in Zambia is its own control, evidenced with the hosting location of each system that holds it, so a cloud service holding health data abroad shows as a gap before the annual audit finds it.
Ready for the annual data audit
Controls carry the deliverables a licensed data auditor will ask for, so the audit draws on records kept through the year rather than evidence gathered in the week before.
Beside the Cyber Security Act 2025
Organisations designated as critical information infrastructure assess personal data controls on the same model as ISO/IEC 27001, so hosting, audit and incident evidence is collected once for both laws.
Zambia DPA frequently asked questions
When was the deadline to register with Zambia's Data Protection Commissioner?
30 April 2025, for all data controllers and processors. Processing personal data without registration is an offence under the Act, so an organisation that missed the deadline should register now.
How fast must a personal data breach be reported in Zambia?
Within 24 hours, to the Data Protection Commissioner.
Must personal data be stored in Zambia?
Personal data is to be processed and stored on a server or data centre in Zambia unless the Minister prescribes categories that may be held elsewhere, and sensitive personal data, which includes health data, must be stored in Zambia. Critical information infrastructure must also be hosted in Zambia unless authorised under the Cyber Security Act 2025.
Does every organisation need a data protection officer in Zambia?
Yes. The Act requires every data controller and data processor to appoint a data protection officer.
What is the annual data audit?
The Act subjects processing to an annual audit carried out by the Data Protection Commissioner or by a data auditor licensed under SI 58 of 2021. GRCLens keeps the evidence for it on the same controls used through the year.
One platform, many obligations
See all supported frameworks → Every framework that applies in Zambia →
Talk to us about Zambia DPA
Security Solution Consultants provides Zambia data protection and cyber security advisory alongside the platform, so you can combine tooling with hands-on expertise.