Cyber security compliance in Zambia

Which cyber and data protection laws apply in Zambia?

Three statutes do most of the work. The Data Protection Act No. 3 of 2021 governs personal data and is administered by the Office of the Data Protection Commissioner. The Cyber Security Act No. 3 of 2025 governs the protection of critical information infrastructure and the licensing of cybersecurity services, and the Cyber Crimes Act No. 4 of 2025 sets the offences; both were assented to on 8 April 2025, commenced on 12 May 2025 and replaced the Cyber Security and Cyber Crimes Act 2021. Banks and other financial service providers add the Bank of Zambia's Cyber and Information Risk Management Guidelines.

What does the Data Protection Act 2021 require?

Every data controller and processor had to register with the Commissioner by 30 April 2025 under the Data Protection (Registration and Licensing) Regulations, SI 58 of 2021, which set registration categories for individuals and for micro, medium and large organisations. Every controller and processor must also appoint a data protection officer, and a personal data breach must be reported to the Commissioner within 24 hours.

Personal data is to be processed and stored on a server or data centre in Zambia unless the Minister prescribes otherwise, and sensitive personal data, which includes health data, must stay in Zambia. Large-scale processing of sensitive data needs an impact assessment, and processing is subject to an annual data audit by the Commissioner or a licensed data auditor. Sanctions for some breaches include fines of up to 2% of annual turnover.

What does the Cyber Security Act 2025 require?

The Act created the Zambia Cyber Security Agency in the Office of the President and lists critical sectors that include banking, health, ICT, energy, education and mining. Owners of designated critical information infrastructure must register it within 30 days of designation, host it in Zambia unless authorised, appoint an auditor for an annual cyber audit, notify cyber incidents immediately with a preliminary report within 12 hours, and take part in national cyber exercises.

The Act also licenses cybersecurity services. Penetration testing, security operations centres, risk and vulnerability assessment, incident response, cyber audit and red teaming need a licence from the Agency, and an owner of critical information infrastructure may not engage an unlicensed provider. Penalties for non-compliance reach ZMW 1.2 million, imprisonment of up to 10 years, or both. We could not find published licensing regulations or fees as of October 2026, so check with the Agency before contracting.

What does the Bank of Zambia expect?

The Bank of Zambia's Cyber and Information Risk Management Guidelines were gazetted on 19 May 2023 and issued to the industry by circular in June 2023. They apply on an apply or explain basis and call for board oversight of cyber risk, an independent chief information security officer and an annual security maturity assessment. The Bank knows the threat first hand: it refused to pay a ransom after a ransomware attack in May 2022.

Why mining matters for cyber risk in Zambia

Zambia produced 890,346 tonnes of copper in 2025, up 8% on the year before, against a government target of 3 million tonnes a year by 2031, and new and expanded mines are being built to reach it. Mining is a critical sector under the Cyber Security Act 2025, so the process control systems, plants and supporting IT at large mines may be designated as critical information infrastructure, with the hosting, audit and 12-hour reporting duties that follow.

Safety and environmental management already run on international standards, and ZABS Certification Services is accredited by SADCAS to certify against ISO 45001 and ISO 14001. IEC 62443 gives the matching security requirements for control systems.

How GRCLens runs Zambian frameworks together

The Data Protection Act, ISO/IEC 27001, IEC 62443 and ISO 45001 share one control model in GRCLens, so a mine or bank evidences access control, incident response or supplier assurance once for the Data Protection Commissioner, the Cyber Security Agency and its certification body. The 24-hour breach notice, the 12-hour preliminary incident report and the annual data and cyber audits are tracked as their own items. Because both laws keep data and infrastructure in Zambia, GRCLens can run in your own private cloud or fully on-premises in the country.

Official portals and publications

• Office of the Data Protection Commissioner, questions on registration
• Cyber Security Act No. 3 of 2025 (ZambiaLII)